Subject: [IPsec] VPN policy encrypts traffic between the router and the local network

From: "Gaurav Nagare" <[email-masked]>
Date: Thu, 8 May 2008 18:32:17 +0800

Hi,
Here is the setup for this issue

                                       ____
_____
                                     |          |
|          |
192.168.0.0/16---------------
|SGW1|-----------------------------------|SGW2|------------192.168.11.0/
24
 (Network)                       |_____ |20.1.1.20
20.1.1.21|_____|            (network)

There is a VPN policy in tunnel mode between SGW1 and SGW2. the VPN
tunnel is setup with two networks, 192.168.0.0/16(kind of supernet) and
192.168.11.0/24.

Now, once the IPsec policy in enabled, client on network 192.168.11.0/24
is not able to access the local router interface and trafic between
local network and router is also encrypted. However the router allows
IPsec traffic to pass to a peer on network 192.168.0.0/16.

I am not sure if this behaviour is acceptable or the router should be
accessible from local network. Please let me know your comments.

Regards,
Gaurav

_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

---

From: Stephen Kent <[email-masked]>
Date: Tue, 20 May 2008 16:10:22 -0400

>Content-class: urn:content-classes:message
>Content-Type: multipart/alternative;
>	boundary="----_=_NextPart_001_01C8B0F6.CA652E59"
>
>Hi,
>|SGW1|-----------------------------------|SGW2|------------192.168.11.0/24
>tunnel is setup with two networks, 192.168.0.0/16(kind of supernet) 
>and 192.168.11.0/24.
>
>Now, once the IPsec policy in enabled, client on network 
>192.168.11.0/24 is not able to access the local router interface and 
>trafic between local network and router is also encrypted. However 
>the router allows IPsec traffic to pass to a peer on network 
>192.168.0.0/16.
>
>I am not sure if this behaviour is acceptable or the router should 
>be accessible from local network. Please let me know your comments.
>
>
>Regards,
>Gaurav

If properly implemented and configured, the IPsec policy you 
described above should not affect the ability of a client on the /24 
net to send traffic to any addresses on that local net.

You say that traffic from the client to local router is encrypted. I 
assume u=you mean encrypted using IPsec. If so, that requires that 
the IPsec implementation in the client is enabled, and that the SPD 
in the client calls for such encryption. So, I think you have omitted 
a significant part of the description of the context above.

Steve