denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

swanctl: Reformulate IKEv1 selector restriction, describe problems with TS narrowing

Browse Source
This commit is contained in:
Noel Kuntze
2017-03-23 18:27:05 +01:00
committed by Tobias Brunner
parent a7cd424206
commit 693107f6ae
1 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/swanctl/swanctl.opt
+10 -3
View File
@@ -664,9 +664,16 @@ connections.<conn>.children.<child>.local_ts = dynamic
value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
as well, none of the kernel backends currently support port ranges, though. as well, none of the kernel backends currently support port ranges, though.
Unless the Unity extension is used, IKEv1 supports the first specified When IKEv1 is used only the first selector is interpreted, except if
selector only. IKEv1 uses very similar traffic selector narrowing as it is the Cisco Unity extension plugin is used. This is due to a limitation of the
supported in the IKEv2 protocol. IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
So to tunnel traffic matched by several pairs of selectors when using IKEv1
several children (CHILD_SAs) have to be defined that cover the selectors.
The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
standardized and implemented for IKEv2. However, this may lead to problems
with other implementations. To avoid that, configure identical selectors in
such scenarios.
connections.<conn>.children.<child>.remote_ts = dynamic connections.<conn>.children.<child>.remote_ts = dynamic
Remote selectors to include in CHILD_SA. Remote selectors to include in CHILD_SA.