--- west.console.txt 2019-08-24 18:12:56.196676639 +0000 +++ OUTPUT/west.console.txt 2019-08-26 13:09:05.538727220 +0000 @@ -13,12 +13,16 @@ ../../pluto/bin/wait-for-whack-trafficstatus.sh --timeout 30 westnet-eastnet-auto 006 #2: "westnet-eastnet-auto", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, id='@east' west # + +west # # ensure that clear text does not get through west # iptables -A INPUT -i eth1 -m policy --dir in --pol none -s 192.0.2.0/24 -j LOGDROP west # iptables -I INPUT -m policy --dir in --pol ipsec -j ACCEPT west # + +west # # We expect ping to be encrypted and work; we should see non-zero west # # traffic counters @@ -36,6 +40,8 @@ ipsec whack --trafficstatus 006 #2: "westnet-eastnet-auto", type=ESP, add_time=1234567890, inBytes=336, outBytes=336, id='@east' west # + +west # # sending delete/notify should cause east to re-initiate west # ipsec auto --down westnet-eastnet-auto @@ -44,6 +50,8 @@ 005 "westnet-eastnet-auto" #2: ESP traffic information: in=336B out=336B 002 "westnet-eastnet-auto" #1: deleting state (STATE_PARENT_R2) and sending notification west # + +west # # give Delete/Notify some time; traffic counters on the new IPsec SA west # # should be 0 @@ -51,6 +59,8 @@ ../../pluto/bin/wait-for-whack-trafficstatus.sh --timeout 5 'westnet-eastnet-auto.*inBytes=0' 006 #4: "westnet-eastnet-auto", type=ESP, add_time=1234567890, inBytes=0, outBytes=0, id='@east' west # + +west # # A new IPsec SA should be established (older versions would be dead for 30 seconds) west # ping -n -c 4 -I 192.0.1.254 192.0.2.254