1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
|
/testing/guestbin/swan-prep --x509
Preparing X.509 files
road #
ipsec start
Redirecting to: [initsystem]
road #
../../guestbin/wait-until-pluto-started
road #
ipsec whack --impair revival
road #
ipsec auto --add road
002 "road/0x1": added IKEv2 connection
002 "road/0x2": added IKEv2 connection
002 "road/0x3": added IKEv2 connection
002 "road/0x4": added IKEv2 connection
002 "road/0x5": added IKEv2 connection
002 "road/0x6": added IKEv2 connection
002 "road/0x7": added IKEv2 connection
002 "road/0x8": added IKEv2 connection
road #
echo "initdone"
initdone
road #
ipsec auto --up road
000 initiating all conns with alias='road'
1v2 "road/0x8" #1: initiating IKEv2 connection
000 "road/0x7": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x6": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x5": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x4": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x3": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x2": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
000 "road/0x1": queue Child SA; waiting on IKE SA "road/0x8" #1 negotiating with 192.1.2.23
1v2 "road/0x8" #1: sent IKE_SA_INIT request to 192.1.2.23:500
002 "road/0x8" #1: switching CHILD #2 to pending connection "road/0x1"
1v2 "road/0x8" #1: sent IKE_AUTH request {cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}
003 "road/0x8" #1: initiator established IKE SA; authenticated peer '3nnn-bit RSASSA-PSS with SHA2_512' digital signature using peer certificate 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org' issued by CA 'C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=Libreswan test CA for mainca, E=testing@libreswan.org'
004 "road/0x1" #2: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE NATD=192.1.2.23:4500 DPD=passive}
002 "road/0x2" #3: initiating Child SA using IKE SA #1
002 "road/0x3" #4: initiating Child SA using IKE SA #1
002 "road/0x4" #5: initiating Child SA using IKE SA #1
002 "road/0x5" #6: initiating Child SA using IKE SA #1
002 "road/0x6" #7: initiating Child SA using IKE SA #1
002 "road/0x7" #8: initiating Child SA using IKE SA #1
002 "road/0x8" #9: initiating Child SA using IKE SA #1
1v2 "road/0x2" #3: sent CREATE_CHILD_SA request for new IPsec SA
003 "road/0x2" #3: CREATE_CHILD_SA failed with error notification TS_UNACCEPTABLE
200 "road/0x2" #3: state transition 'initiate create Child SA (CREATE_CHILD_SA)' failed
1v2 "road/0x3" #4: sent CREATE_CHILD_SA request for new IPsec SA
004 "road/0x3" #4: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [192.0.20.0-192.0.20.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATD=192.1.2.23:4500 DPD=passive}
1v2 "road/0x5" #6: sent CREATE_CHILD_SA request for new IPsec SA
004 "road/0x5" #6: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [10.0.1.0-10.0.1.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATD=192.1.2.23:4500 DPD=passive}
1v2 "road/0x6" #7: sent CREATE_CHILD_SA request for new IPsec SA
004 "road/0x6" #7: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [10.0.2.0-10.0.2.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATD=192.1.2.23:4500 DPD=passive}
1v2 "road/0x4" #5: sent CREATE_CHILD_SA request for new IPsec SA
003 "road/0x4" #5: CREATE_CHILD_SA failed with error notification TS_UNACCEPTABLE
200 "road/0x4" #5: state transition 'initiate create Child SA (CREATE_CHILD_SA)' failed
1v2 "road/0x7" #8: sent CREATE_CHILD_SA request for new IPsec SA
004 "road/0x7" #8: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [10.0.3.0-10.0.3.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATD=192.1.2.23:4500 DPD=passive}
1v2 "road/0x8" #9: sent CREATE_CHILD_SA request for new IPsec SA
004 "road/0x8" #9: initiator established Child SA using #1; IPsec tunnel [192.0.3.0-192.0.3.255:0-65535 0] -> [10.0.4.0-10.0.4.255:0-65535 0] {ESPinUDP/ESN=>0xESPESP <0xESPESP xfrm=AES_GCM_16_256-NONE-MODP2048 NATD=192.1.2.23:4500 DPD=passive}
road #
sleep 3
road #
# There should be 6 tunnels up, and 2 broken tunnels
road #
ipsec trafficstatus
006 #2: "road/0x1", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
006 #4: "road/0x3", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
006 #6: "road/0x5", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
006 #7: "road/0x6", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
006 #8: "road/0x7", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
006 #9: "road/0x8", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='C=CA, ST=Ontario, L=Toronto, O=Libreswan, OU=Test Department, CN=east.testing.libreswan.org, E=user-east@testing.libreswan.org'
road #
ipsec showstates
000 #2: "road/0x1":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #2: "road/0x1" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #4: "road/0x3":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #4: "road/0x3" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #6: "road/0x5":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #6: "road/0x5" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #7: "road/0x6":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #7: "road/0x6" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #8: "road/0x7":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #8: "road/0x7" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
000 #1: "road/0x8":4500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in XXs; REPLACE in XXs; newest; idle;
000 #9: "road/0x8":4500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in XXs; REPLACE in XXs; newest; eroute owner; IKE SA #1; idle;
000 #9: "road/0x8" esp.ESPSPIi@192.1.2.23 esp.ESPSPIi@192.1.3.209 tun.0@192.1.2.23 tun.0@192.1.3.209 Traffic: ESPin=0B ESPout=0B ESPmax=2^63B
road #
echo done
done
road #
# order of conns is not stable, let's just check if we have our 6 tunnels
road #
ipsec trafficstatus | wc -l
6
road #
../../guestbin/ipsec-look.sh
road NOW
XFRM state:
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.2.23 dst 192.1.3.209
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
src 192.1.3.209 dst 192.1.2.23
proto esp spi 0xSPISPI reqid REQID mode tunnel
replay-window 0 flag af-unspec esn
aead rfc4106(gcm(aes)) 0xENCAUTHKEY 128
encap type espinudp sport 4500 dport 4500 addr 0.0.0.0
anti-replay esn context:
seq-hi 0x0, seq 0xXX, oseq-hi 0x0, oseq 0xXX
replay_window 128, bitmap-length 4
00000000 00000000 00000000 XXXXXXXX
XFRM policy:
src 10.0.1.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.1.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.2.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.2.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.3.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.3.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.4.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 10.0.4.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 192.0.2.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 192.0.2.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 192.0.20.0/24 dst 192.0.3.0/24
dir fwd priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 192.0.20.0/24 dst 192.0.3.0/24
dir in priority PRIORITY ptype main
tmpl src 192.1.2.23 dst 192.1.3.209
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 10.0.1.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 10.0.2.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 10.0.3.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 10.0.4.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 192.0.2.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
src 192.0.3.0/24 dst 192.0.20.0/24
dir out priority PRIORITY ptype main
tmpl src 192.1.3.209 dst 192.1.2.23
proto esp reqid REQID mode tunnel
XFRM done
IPSEC mangle TABLES
iptables filter TABLE
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ROUTING TABLES
default via 192.1.3.254 dev eth0
10.0.1.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
10.0.2.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
10.0.3.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
10.0.4.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
192.0.2.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
192.0.20.0/24 via 192.1.3.254 dev eth0 src 192.0.3.254
192.1.3.0/24 dev eth0 proto kernel scope link src 192.1.3.209
NSS_CERTIFICATES
Certificate Nickname Trust Attributes
SSL,S/MIME,JAR/XPI
Libreswan test CA for mainca - Libreswan CT,,
east P,,
east-ec P,,
hashsha1 P,,
nic P,,
north P,,
road u,u,u
west P,,
west-ec P,,
road #
|
