/testing/guestbin/swan-prep road # # delete the address 193.1.33.222 before re-run. otherwise pluto may choose it. road # ip addr show dev eth0 | grep 192.1.33.222 && ip addr del 192.1.33.222/24 dev eth0 road # ip route show scope global | grep "192.1.33.254" && ip route del default via 192.1.33.254 road # # add .209 for re-run road # ip addr show dev eth0 | grep 192.1.3.209 || ip addr add 192.1.3.209/24 dev eth0 inet 192.1.3.209/24 brd 192.1.3.255 scope global eth0 road # ip addr add 192.1.33.222/24 dev eth0 road # # add default gw, it could have been deleted due address changes road # ip route | grep default || ip route add default via 192.1.3.254 default via 192.1.3.254 dev eth0 road # # routes and addresses setup for the test road # ipsec start Redirecting to: [initsystem] road # /testing/pluto/bin/wait-until-pluto-started road # ipsec auto --add road-eastnet 002 added connection description "road-eastnet" road # echo "initdone" initdone road # ipsec auto --up road-eastnet 002 "road-eastnet"[1] 192.1.2.23 #1: initiating v2 parent SA 1v2 "road-eastnet"[1] 192.1.2.23 #1: initiate 1v2 "road-eastnet"[1] 192.1.2.23 #1: STATE_PARENT_I1: sent v2I1, expected v2R1 1v2 "road-eastnet"[1] 192.1.2.23 #2: STATE_PARENT_I2: sent v2I2, expected v2R2 {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048} 003 "road-eastnet"[1] 192.1.2.23 #2: Authenticated using authby=secret 002 "road-eastnet"[1] 192.1.2.23 #2: received INTERNAL_IP4_ADDRESS 192.0.3.10 002 "road-eastnet"[1] 192.1.2.23 #2: negotiated connection [192.0.3.10-192.0.3.10:0-65535 0] -> [192.0.2.0-192.0.2.255:0-65535 0] 004 "road-eastnet"[1] 192.1.2.23 #2: STATE_V2_IPSEC_I: IPsec SA established tunnel mode {ESP=>0xESPESP <0xESPESP xfrm=AES_CBC_256-HMAC_SHA2_256_128 NATOA=none NATD=none DPD=passive} road # ping -W 1 -q -n -c 2 192.0.2.254 PING 192.0.2.254 (192.0.2.254) 56(84) bytes of data. --- 192.0.2.254 ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time XXXX rtt min/avg/max/mdev = 0.XXX/0.XXX/0.XXX/0.XXX ms road # ipsec whack --trafficstatus 006 #2: "road-eastnet"[1] 192.1.2.23, type=ESP, add_time=1234567890, inBytes=168, outBytes=168, id='192.1.2.23', lease=192.0.3.10/32 road # # note this end should be 192.1.3.209 road # ip xfrm state src 192.1.2.23 dst 192.1.3.209 proto esp spi 0xSPISPI reqid REQID mode tunnel enc cbc(aes) 0xENCKEY src 192.1.3.209 dst 192.1.2.23 proto esp spi 0xSPISPI reqid REQID mode tunnel enc cbc(aes) 0xENCKEY road # ip xfrm policy src 192.0.3.10/32 dst 192.0.2.0/24 dir out priority 1040359 ptype main tmpl src 192.1.3.209 dst 192.1.2.23 src 192.0.2.0/24 dst 192.0.3.10/32 dir fwd priority 1040359 ptype main tmpl src 192.1.2.23 dst 192.1.3.209 src 192.0.2.0/24 dst 192.0.3.10/32 dir in priority 1040359 ptype main tmpl src 192.1.2.23 dst 192.1.3.209 road # sleep 5 road # # remove this end ip next one will take over road # ip route show scope global | grep 192.1.3.254 && ip route del default via 192.1.3.254 default via 192.1.3.254 dev eth0 road # ip route show scope global | grep 192.1.33.254 || ip route add default via 192.1.33.254 road # ip addr del 192.1.3.209/24 dev eth0 road # # let libreswan detect change and do a MOBIKE update road # sleep 10 road # # both ends updated MOBIKE ping should work road # # note this end should be 192.1.33.222 road # ping -W 1 -q -n -c 4 192.0.2.254 PING 192.0.2.254 (192.0.2.254) 56(84) bytes of data. --- 192.0.2.254 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time XXXX rtt min/avg/max/mdev = 0.XXX/0.XXX/0.XXX/0.XXX ms road # echo done done road # ipsec whack --trafficstatus 006 #2: "road-eastnet"[1] 192.1.2.23, type=ESP, add_time=1234567890, inBytes=336, outBytes=336, id='192.1.2.23', lease=192.0.3.10/32 road # ../../pluto/bin/ipsec-look.sh road NOW XFRM state: src 192.1.2.23 dst 192.1.33.222 proto esp spi 0xSPISPI reqid REQID mode tunnel enc cbc(aes) 0xENCKEY src 192.1.33.222 dst 192.1.2.23 proto esp spi 0xSPISPI reqid REQID mode tunnel enc cbc(aes) 0xENCKEY XFRM policy: src 192.0.2.0/24 dst 192.0.3.10/32 dir fwd priority 1040359 ptype main tmpl src 192.1.2.23 dst 192.1.33.222 src 192.0.2.0/24 dst 192.0.3.10/32 dir in priority 1040359 ptype main tmpl src 192.1.2.23 dst 192.1.33.222 src 192.0.3.10/32 dst 192.0.2.0/24 dir out priority 1040359 ptype main tmpl src 192.1.33.222 dst 192.1.2.23 XFRM done IPSEC mangle TABLES NEW_IPSEC_CONN mangle TABLES ROUTING TABLES default via 192.1.33.254 dev eth0 192.0.2.0/24 via 192.1.33.254 dev eth0 src 192.0.3.10 192.1.33.0/24 dev eth0 proto kernel scope link src 192.1.33.222 NSS_CERTIFICATES Certificate Nickname Trust Attributes SSL,S/MIME,JAR/XPI road # road # ../bin/check-for-core.sh road # if [ -f /sbin/ausearch ]; then ausearch -r -m avc -ts recent ; fi