Andreas Steffen
7c5a2974b9
For documentation purposes the new folders ikev1-algs, ikev2-algs, ikev1-multi-ca and ikev2-multi-ca have been created. Most of the test cases have now been converted to the vici interface. The remaining legacy stroke scenarios yet to be converted have been put into the ikev2-stroke-bye folder. For documentation purposes some legacy stroke scenarios will be kept in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
9 lines
604 B
Plaintext
9 lines
604 B
Plaintext
An IPsec <b>transport-mode</b> connection between the natted host <b>alice</b>
|
|
and gateway <b>sun</b> is successfully set up. The client <b>venus</b> behind
|
|
the same NAT as client <b>alice</b> also establishes the same <b>transport-mode</b>
|
|
connection. <b>sun</b> uses the connmark plugin and a <b>%unique</b> mark on
|
|
the CHILD_SAs to select the correct return path SA using connection tracking.
|
|
This allows <b>sun</b> to talk to both nodes for client initiated flows, even
|
|
if the SAs are actually both over <b>moon</b>.<br/>
|
|
To test the connection, both hosts establish an SSH connection to <b>sun</b>.
|