PRE-TEST

moon# ipsec start
Starting strongSwan 4.2.17 IPsec [starter]...

carol# ipsec start
Starting strongSwan 4.2.17 IPsec [starter]...

carol# sleep 2 

carol# ipsec up home
002 "home" #1: initiating Main Mode
104 "home" #1: STATE_MAIN_I1: initiate
003 "home" #1: ignoring Vendor ID payload [strongSwan 4.2.17]
003 "home" #1: received Vendor ID payload [XAUTH]
003 "home" #1: received Vendor ID payload [Dead Peer Detection]
106 "home" #1: STATE_MAIN_I2: sent MI2, expecting MR2
002 "home" #1: we have a cert and are sending it upon request
108 "home" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "home" #1: Peer ID is ID_FQDN: '@moon.strongswan.org'
002 "home" #1: crl not found
002 "home" #1: certificate status unknown
002 "home" #1: ISAKMP SA established
004 "home" #1: STATE_MAIN_I4: ISAKMP SA established
002 "home" #2: initiating Quick Mode RSASIG+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "home" #2: STATE_QUICK_I1: initiate
002 "home" #2: sent QI2, IPsec SA established {ESP=>0x510e1fee <0xdf29d602}
004 "home" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x510e1fee <0xdf29d602}


TEST

carol# ipsec status | grep 'STATE_MAIN_I4 (ISAKMP SA established)' [YES]
000 #1: "home" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3333s; newest ISAKMP

carol# iptables -A INPUT -i eth0 -s 192.168.0.1 -j DROP | grep 'no output expected' [NO]

moon# sleep 50 | grep 'no output expected' [NO]

moon# cat /var/log/auth.log | grep 'inserting event EVENT_DPD' [YES]
Jul 20 14:24:15 moon pluto[8375]: | inserting event EVENT_DPD, timeout in 13 seconds for #2
Jul 20 14:24:28 moon pluto[8375]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 14:24:28 moon pluto[8375]: | inserting event EVENT_DPD_TIMEOUT, timeout in 30 seconds for #1
Jul 20 14:24:38 moon pluto[8375]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 14:24:48 moon pluto[8375]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Jul 20 14:24:58 moon pluto[8375]: | inserting event EVENT_DPD, timeout in 10 seconds for #2

moon# cat /var/log/auth.log | grep 'DPD: No response from peer - declaring peer dead' [YES]
Jul 20 14:24:58 moon pluto[8375]: "rw"[1] 192.168.0.100 #1: DPD: No response from peer - declaring peer dead

moon# cat /var/log/auth.log | grep 'DPD: Terminating all SAs using this connection' [YES]
Jul 20 14:24:58 moon pluto[8375]: "rw"[1] 192.168.0.100 #1: DPD: Terminating all SAs using this connection

moon# cat /var/log/auth.log | grep 'DPD: Clearing connection' [YES]
Jul 20 14:24:58 moon pluto[8375]: DPD: Clearing connection "rw"


POST-TEST

carol# iptables -D INPUT -i eth0 -s 192.168.0.1 -j DROP

moon# ipsec stop
Stopping strongSwan IPsec...

carol# ipsec stop
Stopping strongSwan IPsec...