TCPDUMP

moon# tcpdump -i eth0 not port ssh and not port domain and not arp > /tmp/tcpdump.log 2>&1 &

PRE-TEST

moon# echo 1 > /proc/sys/net/ipv4/ip_forward

moon# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

carol# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

dave# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

carol# sleep 1 

carol# ipsec up home
002 "home" #1: initiating Main Mode
104 "home" #1: STATE_MAIN_I1: initiate
003 "home" #1: ignoring Vendor ID payload [strongSwan]
003 "home" #1: received Vendor ID payload [XAUTH]
003 "home" #1: received Vendor ID payload [Dead Peer Detection]
106 "home" #1: STATE_MAIN_I2: sent MI2, expecting MR2
002 "home" #1: we have a cert and are sending it upon request
108 "home" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "home" #1: Peer ID is ID_FQDN: 'moon.strongswan.org'
002 "home" #1: crl not found
002 "home" #1: certificate status unknown
002 "home" #1: ISAKMP SA established
004 "home" #1: STATE_MAIN_I4: ISAKMP SA established
002 "home" #2: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "home" #2: STATE_QUICK_I1: initiate
002 "home" #2: sent QI2, IPsec SA established {ESP=>0x54a41f39 <0x747ac124}
004 "home" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x54a41f39 <0x747ac124}

dave# ipsec up home
initiating IKE_SA home[1] to 192.168.0.1
generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]
sending packet: from 192.168.0.200[500] to 192.168.0.1[500]
received packet: from 192.168.0.1[500] to 192.168.0.200[500]
parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]
received cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
sending cert request for "C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
authentication of 'dave@strongswan.org' (myself) with RSA signature successful
sending end entity cert "C=CH, O=Linux strongSwan, OU=Accounting, CN=dave@strongswan.org"
establishing CHILD_SA home
generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr AUTH SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]
sending packet: from 192.168.0.200[4500] to 192.168.0.1[4500]
received packet: from 192.168.0.1[4500] to 192.168.0.200[4500]
parsed IKE_AUTH response 1 [ IDr CERT AUTH SA TSi TSr N(AUTH_LFT) N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_6_ADDR) N(ADD_6_ADDR) ]
received end entity cert "C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
  using certificate "C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
  using trusted ca certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
checking certificate status of "C=CH, O=Linux strongSwan, CN=moon.strongswan.org"
  fetching crl from 'http://crl.strongswan.org/strongswan.crl' ...
  using trusted certificate "C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
  crl correctly signed by "C=CH, O=Linux strongSwan, CN=strongSwan Root CA"
  crl is valid: until Mar 29 23:27:26 2010
certificate status is good
  reached self-signed root ca with a path length of 0
authentication of 'moon.strongswan.org' with RSA signature successful
IKE_SA home[1] established between 192.168.0.200[dave@strongswan.org]...192.168.0.1[moon.strongswan.org]
scheduling reauthentication in 3278s
maximum IKE_SA lifetime 3458s

dave# sleep 1


TEST

moon# ipsec statusall | grep 'rw.*STATE_QUICK_R2.*IPsec SA established' [YES]
000 #2: "rw"[2] 192.168.0.100 STATE_QUICK_R2 (IPsec SA established); EVENT_SA_REPLACE in 1108s; newest IPSEC; eroute owner

moon# ipsec statusall | grep 'rw.*ESTABLISHED' [YES]
          rw[1]: ESTABLISHED 1 second ago, 192.168.0.1[moon.strongswan.org]...192.168.0.200[dave@strongswan.org]

carol# ipsec statusall | grep 'home.*STATE_QUICK_I2.*IPsec SA established' [YES]
000 #2: "home" STATE_QUICK_I2 (sent QI2, IPsec SA established); EVENT_SA_REPLACE in 947s; newest IPSEC; eroute owner

dave# ipsec statusall | grep 'home.*ESTABLISHED' [YES]
        home[1]: ESTABLISHED 2 seconds ago, 192.168.0.200[dave@strongswan.org]...192.168.0.1[moon.strongswan.org]

carol# ping -c 1 10.1.0.10 | grep '64 bytes from 10.1.0.10: icmp_seq=1' [YES]
64 bytes from 10.1.0.10: icmp_seq=1 ttl=63 time=1.77 ms

dave# ping -c 1 10.1.0.10 | grep '64 bytes from 10.1.0.10: icmp_seq=1' [YES]
64 bytes from 10.1.0.10: icmp_seq=1 ttl=63 time=0.343 ms

moon# killall tcpdump

moon# cat /tmp/tcpdump.log | grep 'IP carol.strongswan.org > moon.strongswan.org: ESP' [YES]
22:34:50.734925 IP carol.strongswan.org > moon.strongswan.org: ESP(spi=0x54a41f39,seq=0x1), length 132

moon# cat /tmp/tcpdump.log | grep 'IP moon.strongswan.org > carol.strongswan.org: ESP' [YES]
22:34:50.736523 IP moon.strongswan.org > carol.strongswan.org: ESP(spi=0x747ac124,seq=0x1), length 132

moon# cat /tmp/tcpdump.log | grep 'IP dave.strongswan.org > moon.strongswan.org: ESP' [YES]
22:34:50.880298 IP dave.strongswan.org > moon.strongswan.org: ESP(spi=0xc6e1d2c6,seq=0x1), length 132

moon# cat /tmp/tcpdump.log | grep 'IP moon.strongswan.org > dave.strongswan.org: ESP' [YES]
22:34:50.880492 IP moon.strongswan.org > dave.strongswan.org: ESP(spi=0xc2df5290,seq=0x1), length 132


POST-TEST

moon# ipsec stop
Stopping strongSwan IPsec...

carol# ipsec stop
Stopping strongSwan IPsec...

dave# ipsec stop
Stopping strongSwan IPsec...