Administrace komentářů

Zdravim.

Mam IPsec tunel S2S medzi lokalnym serverom (lokalna LAN siet 10.10.10.0/24 a lokalna (Open)VPN siet 10.81.0.0/16) a vzdialenym MikroTik-om, ktory je za NAT-om (vzdialena MKT siet 192.168.101.0/24). MKT inicializuje spojenie. Tunel sa naviaze a vsetko vyzera OK.

Problem je, ze spojenie funguje vzdy len z jednej lokalnej siete (bud LAN alebo VPN):

10.10.10.0/24 <-> 192.168.101.0/24 - OK

10.81.0.0/16 <-> 192.168.101.0/24 - nefunguje

alebo naopak. To, ktora siet bude fungovat som zatial este neodsledoval, ale mam pocit, ze je to nahodne (po restarte strongswan na lokalnom serveri).

Ked z lokalnej siete, ktora nefunguje, pingam vzdialene PC, tak na MKT vidim, ze vzdialene PC odpoveda na ping, ale neprejde to uz bud do tunela, alebo to z neho nevyjde na lokalnom serveri (je tam trafik, takze je problem odsledovat ESP pakety).

Sprava sa to rovnako pri IKEv1 aj IKEv2.

Lokalny server: CentOS 7, strongswan-5.7.1-1.el7, verejna IP

ipsec.conf

config setup

conn base
    fragmentation=yes
    dpdaction=restart
    dpddelay=120s

conn lan1
    also=base
    keyexchange=ikev2
    mobike=no
    left=1.1.1.1
    leftsubnet=10.10.10.0/24
    right=%any
    rightsubnet=192.168.101.0/24
    authby=psk
    ike=aes128-sha1-modp1536
    esp=aes128-sha1-modp1536
    ikelifetime=1d
    lifetime=1h
    margintime=9m
    keyingtries=%forever
    rekey=no
#    auto=start
    auto=route

conn lan2
    also=base
    keyexchange=ikev2
    mobike=no
    left=1.1.1.1
    leftsubnet=10.81.0.0/16
    right=%any
    rightsubnet=192.168.101.0/24
    authby=psk
    ike=aes128-sha1-modp1536
    esp=aes128-sha1-modp1536
    ikelifetime=1d
    lifetime=1h
    margintime=9m
    keyingtries=%forever
    rekey=no
    auto=route

strongswan statusall

Connections:
lan1:  1.1.1.1...%any  IKEv2, dpddelay=120s
lan1:   local:  [1.1.1.1] uses pre-shared key authentication
lan1:   remote: uses pre-shared key authentication
lan1:   child:  10.10.10.0/24 === 192.168.101.0/24 TUNNEL, dpdaction=restart
lan2:   child:  10.81.0.0/16 === 192.168.101.0/24 TUNNEL, dpdaction=restart
Security Associations (1 up, 0 connecting):
lan1[1]: ESTABLISHED 10 seconds ago, 1.1.1.1[1.1.1.1]...2.2.2.2[192.168.1.102]
lan1[1]: IKEv2 SPIs: a0bb837a343ba52b_i cade29f30cf3c13a_r*, rekeying disabled
lan1[1]: IKE proposal: AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536
lan1{1}:  INSTALLED, TUNNEL, reqid 1, ESP in UDP SPIs: cf51c3da_i 0697cfc9_o
lan1{1}:  AES_CBC_128/HMAC_SHA1_96, 0 bytes_i, 524 bytes_o (7 pkts, 0s ago), rekeying disabled
lan1{1}:   10.10.10.0/24 === 192.168.101.0/24
lan2{2}:  INSTALLED, TUNNEL, reqid 2, ESP in UDP SPIs: cc888691_i 0698f9ae_o
lan2{2}:  AES_CBC_128/HMAC_SHA1_96/MODP_1536, 3114 bytes_i (27 pkts, 0s ago), 1128 bytes_o (16 pkts, 0s ago), rekeying disabled
lan2{2}:   10.81.0.0/16 === 192.168.101.0/24

MKT - RouterOS v6.43.7, WAN rozhranie ma privatnu IP (DHCP) 192.168.1.102

Vdaka za akukolvek radu.