PRE-TEST

moon# ipsec start
Starting strongSwan IPsec 2.8.11 [starter]...

carol# ipsec start
Starting strongSwan IPsec 2.8.11 [starter]...

carol# sleep 2 

carol# ipsec up home
002 "home" #1: initiating Main Mode
104 "home" #1: STATE_MAIN_I1: initiate
003 "home" #1: ignoring Vendor ID payload [strongSwan 2.8.11]
003 "home" #1: received Vendor ID payload [XAUTH]
003 "home" #1: received Vendor ID payload [Dead Peer Detection]
106 "home" #1: STATE_MAIN_I2: sent MI2, expecting MR2
002 "home" #1: we have a cert and are sending it 
108 "home" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "home" #1: Peer ID is ID_FQDN: '@moon.strongswan.org'
002 "home" #1: crl not found
002 "home" #1: certificate status unknown
002 "home" #1: ISAKMP SA established
004 "home" #1: STATE_MAIN_I4: ISAKMP SA established
002 "home" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "home" #2: STATE_QUICK_I1: initiate
002 "home" #2: sent QI2, IPsec SA established {ESP=>0x9cc658b4 <0x703ba051}
004 "home" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x9cc658b4 <0x703ba051}


TEST

carol# ipsec status | grep 'STATE_MAIN_I4 (ISAKMP SA established)' [YES]
000 #1: "home" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3324s; newest ISAKMP

carol# iptables -A INPUT -i eth0 -s 192.168.0.1 -j DROP | grep 'no output expected' [NO]

moon# ipsec statusall | grep 'DPD active' [YES]
000 #1: "rw"[1] 192.168.0.100 STATE_MAIN_R3 (sent MR3, ISAKMP SA established); EVENT_SA_REPLACE in 3507s; newest ISAKMP; DPD active

moon# sleep 50 | grep 'no output expected' [NO]

moon# cat /var/log/auth.log | grep 'inserting event EVENT_DPD' [YES]
Jul 20 06:58:05 moon pluto[6410]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 06:58:15 moon pluto[6410]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 06:58:15 moon pluto[6410]: | inserting event EVENT_DPD_TIMEOUT, timeout in 30 seconds for #1
Jul 20 06:58:25 moon pluto[6410]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 06:58:35 moon pluto[6410]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 06:58:45 moon pluto[6410]: | inserting event EVENT_DPD, timeout in 10 seconds for #2

moon# cat /var/log/auth.log | grep 'DPD: No response from peer - declaring peer dead' [YES]
Jul 20 06:58:45 moon pluto[6410]: "rw"[1] 192.168.0.100 #1: DPD: No response from peer - declaring peer dead

moon# cat /var/log/auth.log | grep 'DPD: Terminating all SAs using this connection' [YES]
Jul 20 06:58:45 moon pluto[6410]: "rw"[1] 192.168.0.100 #1: DPD: Terminating all SAs using this connection

moon# cat /var/log/auth.log | grep 'DPD: Clearing connection' [YES]
Jul 20 06:58:46 moon pluto[6410]: DPD: Clearing connection


POST-TEST

carol# iptables -D INPUT -i eth0 -s 192.168.0.1 -j DROP

moon# ipsec stop
Stopping strongSwan IPsec...

carol# ipsec stop
Stopping strongSwan IPsec...