Subject: [Ipsec] IPSEC Tunnel Supernet/Subnet fallover

From: anshul makkar <[email-masked]>
Date: Mon, 7 Jan 2008 07:30:28 -0800 (PST)

Hi,

I established  two IPSEC tunnels terminating at one hub.
Configuration :
1st tunnel : right subnet as 192.168.4.0/24
2nd tunnel: right subnet as 192.168.0.0/16

Both the tunnels have same gateway as 172.16.28.108

I am using freeswan code.

Now what I am observing is that, if I disable the 192.168.4.0/24 tunnel, and
send ping request to 192.168.4.1, the ICMP IPSEC SA is negotiated for 2nd
tunnel (supernet one which is already correctly established.). Why this is
happening.

Further, on continuous pinging (to machine on network 192.168.4.0/24), a new
IPSEC SA (for tunnel 192.168.0.0/26) is negotiated on every request.

On debugging I found that when I disable a perticular tunnel, the path
corresponding to it is marked as trapped. Now klips capture the outbound
packets on the trapped path and tries to send it through another closest
matched active path. Thus in this scenrio, klips is capturing the outbound
packets destined for 192.168.4.0/24 subnet and is trying to transfer it
through 192.168.0.0/16. Is my inference correct.

If this is the default behavior, then why IPSEC SA is being renegotiated for
every outbound ICMP packet. (IPSEC SA should be established once and then
used for every evey ping request)

Please if you have any hint or refernce then please do share it .

Thanking You
Anshul Makkar 
-- 
View this message in context: http://www.nabble.com/IPSEC-Tunnel-Supernet-Subnet-fallover-tp14668175p14668175.html
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

_______________________________________________
IPsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: anshul makkar <[email-masked]>
Date: Mon, 7 Jan 2008 10:26:25 -0800 (PST)

Hi,

Further add to the scenerio, due to continuous negotiaton of IPSEC SA of 2nd
tunnel, for every ICMP packet destined for 1st, 2nd tunnel also gets torn
down in due course of time. 

I am unable to figure out, whether the behavior that I am observing is
desired or there is some thing wrong.

One more point, if instead of subnet /supernet , I establish two tunnels
with different subnets, then they both work fine without disturbing each
other (even in case when one of the tunnel is disabled).
Please reply.

Thanks
Anshul Makkar

anshul makkar wrote:
> Now what I am observing is that, if I disable the 192.168.4.0/24 tunnel,
> and send ping request to 192.168.4.1, the ICMP IPSEC SA is negotiated for
> 2nd tunnel (supernet one which is already correctly established.). Why
> this is happening.
> 
> Further, on continuous pinging (to machine on network 192.168.4.0/24), a
> new IPSEC SA (for tunnel 192.168.0.0/26) is negotiated on every request.
> 
> If this is the default behavior, then why IPSEC SA is being renegotiated
> for every outbound ICMP packet. (IPSEC SA should be established once and
> then used for every evey ping request)
> 

-- 
View this message in context: http://www.nabble.com/IPSEC-Tunnel-Supernet-Subnet-fallover-tp14668175p14672416.html
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

---

From: anshul makkar <[email-masked]>
Date: Mon, 7 Jan 2008 17:31:09 -0800 (PST)

Hi,

Please if any has any idea or any reference material regarding the concernet
problem, then do share it.

Thanks
Anshul Makkar

anshul makkar wrote:
> 
> Hi,
> 
> Further add to the scenerio, due to continuous negotiaton of IPSEC SA of
> 2nd tunnel, for every ICMP packet destined for 1st, 2nd tunnel also gets
> torn down in due course of time. 
> 
>> matched active path. Thus in this scenrio, klips is capturing the
>> outbound packets destined for 192.168.4.0/24 subnet and is trying to
>> transfer it through 192.168.0.0/16. Is my inference correct.
>> 

-- 
View this message in context: http://www.nabble.com/IPSEC-Tunnel-Supernet-Subnet-fallover-tp14668175p14680485.html
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

---

From: anshul makkar <[email-masked]>
Date: Mon, 14 Jan 2008 09:57:47 -0800 (PST)

Hi,
Please reply . I am still stuck with this problem.

If any of you have any hint or reference material/link, then do share it.

Thanks
Anshul Makkar

anshul makkar wrote:
> 
> Hi,
> 
> Please if any has any idea or any reference material regarding the
> concernet problem, then do share it.
> 
> Thanks
> Anshul Makkar
> 
> anshul makkar wrote:
>> 
>> Hi,
>> 
>>> and send ping request to 192.168.4.1, the ICMP IPSEC SA is negotiated
>>> for 2nd tunnel (supernet one which is already correctly established.).
>>> Why this is happening.
>>> 

-- 
View this message in context: http://www.nabble.com/IPSEC-Tunnel-Supernet-Subnet-fallover-tp14668175p14807047.html
Sent from the IETF - Ipsec mailing list archive at Nabble.com.

---

From: Scott G Kelly <[email-masked]>
Date: Sat, 19 Jan 2008 10:47:53 -0800

Hi Anshul,

People are not replying because this list is not really appropriate for
your posts. This list is meant for discussion of IPsec-related
standards, not any particular implementation or problems you might be
having with using it. You should try one of the linux or bsd ipsec
mailing lists.

Scott