TCPDUMP bob# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 & moon# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 & sun# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 & PRE-TEST alice# /etc/init.d/net.eth1 start * Caching service dependencies ... [ ok ] * Starting eth1 * Bringing up eth1 * 192.168.0.50 [ ok ] * fec0::5/16 [ ok ] alice# /etc/init.d/iptables start 2> /dev/null * Starting firewall ... [ ok ] sun# /etc/init.d/iptables start 2> /dev/null * Caching service dependencies ... [ ok ] * Starting firewall ... [ ok ] moon# echo 1 > /proc/sys/net/ipv4/ip_forward sun# ip route add 10.1.0.0/16 via 192.168.0.1 alice# ipsec start Starting strongSwan 4.2.10 IPsec [starter]... sun# ipsec start Starting strongSwan 4.2.10 IPsec [starter]... alice# sleep 2 alice# ipsec up mobike initiating IKE_SA mobike[1] to 192.168.0.2 generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] sending packet: from 192.168.0.50[500] to 192.168.0.2[500] received packet: from 192.168.0.2[500] to 192.168.0.50[500] parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ ] received cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" sending cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" authentication of 'alice@strongswan.org' (myself) with RSA signature successful sending end entity cert "C=CH, O=Linux strongSwan, OU=Sales, CN=alice@strongswan.org" establishing CHILD_SA mobike generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ] sending packet: from 192.168.0.50[4500] to 192.168.0.2[4500] received packet: from 192.168.0.2[4500] to 192.168.0.50[4500] parsed IKE_AUTH response 1 [ IDr CERT AUTH SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ] received end entity cert "C=CH, O=Linux strongSwan, CN=sun.strongswan.org" using certificate "C=CH, O=Linux strongSwan, CN=sun.strongswan.org" using trusted ca certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" checking certificate status of "C=CH, O=Linux strongSwan, CN=sun.strongswan.org" fetching crl from 'http://crl.strongswan.org/strongswan.crl' ... using trusted certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" crl correctly signed by "C=CH, O=Linux strongSwan, CN=strongSwan Root CA" crl is valid: until Jan 25 08:45:40 2009 certificate status is good authentication of 'sun.strongswan.org' with RSA signature successful scheduling reauthentication in 3380s maximum IKE_SA lifetime 3560s IKE_SA mobike[1] established between 192.168.0.50[alice@strongswan.org]...192.168.0.2[sun.strongswan.org] alice# sleep 1 TEST alice# ipsec statusall | grep 'ESTABLISHED.*192.168.0.50.*192.168.0.2' [YES] mobike[1]: ESTABLISHED 1 second, 192.168.0.50[alice@strongswan.org]...192.168.0.2[sun.strongswan.org] sun# ipsec statusall | grep 'ESTABLISHED.*192.168.0.2.*192.168.0.50' [YES] mobike[1]: ESTABLISHED 2 seconds, 192.168.0.2[sun.strongswan.org]...192.168.0.50[alice@strongswan.org] alice# ipsec statusall | grep '192.168.0.50/32 === 10.2.0.0/16' [YES] mobike{1}: 192.168.0.50/32 === 10.2.0.0/16 sun# ipsec statusall | grep '10.2.0.0/16 === 192.168.0.50/32' [YES] mobike{1}: 10.2.0.0/16 === 192.168.0.50/32 alice# ping -c 1 10.2.0.10 | grep '64 bytes from 10.2.0.10: icmp_seq=1' [YES] 64 bytes from 10.2.0.10: icmp_seq=1 ttl=63 time=16.7 ms alice# /etc/init.d/net.eth1 stop | grep 'No output expected' [NO] alice# sleep 1 | grep 'No output expected' [NO] alice# ipsec statusall | grep 'ESTABLISHED.*10.1.0.10.*192.168.0.2' [YES] mobike[1]: ESTABLISHED 16 seconds, 10.1.0.10[alice@strongswan.org]...192.168.0.2[sun.strongswan.org] sun# ipsec statusall | grep 'ESTABLISHED.*192.168.0.2.*10.1.0.10' [YES] mobike[1]: ESTABLISHED 17 seconds, 192.168.0.2[sun.strongswan.org]...10.1.0.10[alice@strongswan.org] alice# ipsec statusall | grep '10.1.0.10/32 === 10.2.0.0/16' [YES] mobike{1}: 10.1.0.10/32 === 10.2.0.0/16 sun# ipsec statusall | grep '10.2.0.0/16 === 10.1.0.10/32' [YES] mobike{1}: 10.2.0.0/16 === 10.1.0.10/32 alice# ping -c 1 10.2.0.10 | grep '64 bytes from 10.2.0.10: icmp_seq=1' [YES] 64 bytes from 10.2.0.10: icmp_seq=1 ttl=63 time=1.49 ms sun# killall tcpdump sun# cat /tmp/tcpdump.log | grep 'alice1.strongswan.org.*sun.strongswan.org: ESP.*seq=0x1' [YES] 11:05:08.139040 IP alice1.strongswan.org > sun.strongswan.org: ESP(spi=0xc357d323,seq=0x1), length 132 sun# cat /tmp/tcpdump.log | grep 'sun.strongswan.org.*alice1.strongswan.org: ESP.*seq=0x1' [YES] 11:05:08.155378 IP sun.strongswan.org > alice1.strongswan.org: ESP(spi=0xc00ca035,seq=0x1), length 132 moon# killall tcpdump moon# cat /tmp/tcpdump.log | grep 'alice.strongswan.org.*sun.strongswan.org: ESP.*seq=0x2' [YES] 11:05:23.133926 IP alice.strongswan.org > sun.strongswan.org: ESP(spi=0xc357d323,seq=0x2), length 132 moon# cat /tmp/tcpdump.log | grep 'sun.strongswan.org.*alice.strongswan.org: ESP.*seq=0x2' [YES] 11:05:23.134822 IP sun.strongswan.org > alice.strongswan.org: ESP(spi=0xc00ca035,seq=0x2), length 132 bob# killall tcpdump bob# cat /tmp/tcpdump.log | grep 'alice1.strongswan.org.*bob.strongswan.org.*ICMP echo request' [YES] 11:05:07.197449 IP alice1.strongswan.org > bob.strongswan.org: ICMP echo request, id 13094, seq 1, length 64 bob# cat /tmp/tcpdump.log | grep 'bob.strongswan.org.*alice1.strongswan.org.*ICMP echo reply' [YES] 11:05:07.203980 IP bob.strongswan.org > alice1.strongswan.org: ICMP echo reply, id 13094, seq 1, length 64 bob# cat /tmp/tcpdump.log | grep 'alice.strongswan.org.*bob.strongswan.org.*ICMP echo request' [YES] 11:05:22.356652 IP alice.strongswan.org > bob.strongswan.org: ICMP echo request, id 50471, seq 1, length 64 bob# cat /tmp/tcpdump.log | grep 'bob.strongswan.org.*alice.strongswan.org.*ICMP echo reply' [YES] 11:05:22.356726 IP bob.strongswan.org > alice.strongswan.org: ICMP echo reply, id 50471, seq 1, length 64 POST-TEST alice# ipsec stop Stopping strongSwan IPsec... sun# ipsec stop Stopping strongSwan IPsec... alice# /etc/init.d/iptables stop 2> /dev/null * Stopping firewall ... [ ok ] sun# /etc/init.d/iptables stop 2> /dev/null * Stopping firewall ... [ ok ] sun# ip route del 10.1.0.0/16 via 192.168.0.1