Hi @nagrajk1969
So right now I'm not interested in traffic on the 172.24.16.0/22 subnet, only traffic on the VPNs. I want something like This topology And that shows both Site A & C VPNs are configured without specific rules for the site B network, and that all subnets do not overlap. However the configs are incomplete and seem to be old (single interface NAT doesn't seem to be an option). I don't have strongswan configured with 172.24.16.0/22 as the rightsubnet, because then it wouldn't route traffic for 172. 24.22.0/23 through the VPN.
So right now my strongswan on the vpn-dev side is up:
ipsec statusall
Status of IKE charon daemon (strongSwan 5.9.1, Linux 5.12.11, x86_64):
uptime: 14 hours, since Jun 29 16:59:29 2021
malloc: sbrk 2994176, mmap 0, used 1151216, free 1842960
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 3
loaded plugins: charon aesni aes des rc2 sha2 sha3 sha1 md5 mgf1 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt af-alg fips-prf gmp curve25519 xcbc cmac hmac drbg curl files sqlite attr kernel-netlink resolve socket-default connmark farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-simaka-pseudonym eap-simaka-reauth eap-mschapv2 eap-radius eap-tls eap-ttls xauth-generic xauth-eap dhcp lookip unity counters
Listening IP addresses:
192.168.1.35
172.24.20.1
Connections:
vpn: 192.168.1.35...98.x.x.x IKEv1
vpn: local: [68.x.x.x] uses pre-shared key authentication
vpn: remote: [98.x.x.x] uses pre-shared key authentication
vpn: child: 172.24.20.0/23 === 172.24.22.0/23 TUNNEL
Security Associations (1 up, 0 connecting):
vpn[2]: ESTABLISHED 7 hours ago, 192.168.1.35[68.x.x.x]...98.x.x.x[98.x.x.x]
vpn[2]: IKEv1 SPIs: 0af84b2f3564ead6_i f27e41c667016147_r*, pre-shared key reauthentication in 34 minutes
vpn[2]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
vpn{20}: INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: c045b695_i 6bc83427_o
vpn{20}: AES_CBC_256/HMAC_SHA1_96, 0 bytes_i, 90972 bytes_o (1083 pkts, 0s ago), rekeying in 28 minutes
vpn{20}: 172.24.20.0/23 === 172.24.22.0/23And it is up on the vpn-prod side:
strongswan statusall
Status of IKE charon daemon (strongSwan 5.7.2, Linux 4.14.232-176.381.amzn2.aarch64, aarch64):
uptime: 14 hours, since Jun 29 20:59:43 2021
malloc: sbrk 2822144, mmap 0, used 932192, free 1889952
worker threads: 11 of 16 idle, 5/0/0/0 working, job queue: 0/0/0/0, scheduled: 7
loaded plugins: charon pkcs11 tpm aes des rc2 sha2 sha1 md4 md5 mgf1 random nonce x509 revocation constraints acert pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt fips-prf gmp curve25519 chapoly xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default farp stroke vici updown eap-identity eap-sim eap-aka eap-aka-3gpp eap-aka-3gpp2 eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap xauth-generic xauth-eap xauth-pam xauth-noauth dhcp led duplicheck unity counters
Listening IP addresses:
172.31.39.159
172.24.22.1
Connections:
vpn: 172.31.39.159...98.129.244.95 IKEv1
vpn: local: [18.x.x.x] uses pre-shared key authentication
vpn: remote: [98.x.x.x] uses pre-shared key authentication
vpn: child: 172.24.22.0/23 === 172.24.20.0/23 TUNNEL
Security Associations (1 up, 0 connecting):
vpn[2]: ESTABLISHED 2 seconds ago, 172.31.39.159[18.x.x.x]...98.x.x.x[98.x.x.x]
vpn[2]: IKEv1 SPIs: 60986a89b8cdaa35_i* c4df864bcafb6b05_r, pre-shared key reauthentication in 7 hours
vpn[2]: IKE proposal: AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
vpn{2}: INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: cdfe88e7_i 1c735002_o
vpn{2}: AES_CBC_256/HMAC_SHA1_96, 0 bytes_i, 0 bytes_o, rekeying in 44 minutes
vpn{2}: 172.24.22.0/23 === 172.24.20.0/23Adding "same-security-traffic permit intra-interface" didn't seem to make things work either.
