PRE-TEST

moon# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

carol# ipsec start
Starting strongSwan 4.3.6 IPsec [starter]...

carol# sleep 2 

carol# ipsec up home
002 "home" #1: initiating Main Mode
104 "home" #1: STATE_MAIN_I1: initiate
003 "home" #1: ignoring Vendor ID payload [strongSwan]
003 "home" #1: received Vendor ID payload [XAUTH]
003 "home" #1: received Vendor ID payload [Dead Peer Detection]
106 "home" #1: STATE_MAIN_I2: sent MI2, expecting MR2
002 "home" #1: we have a cert and are sending it upon request
108 "home" #1: STATE_MAIN_I3: sent MI3, expecting MR3
002 "home" #1: Peer ID is ID_FQDN: 'moon.strongswan.org'
002 "home" #1: crl not found
002 "home" #1: certificate status unknown
002 "home" #1: ISAKMP SA established
004 "home" #1: STATE_MAIN_I4: ISAKMP SA established
002 "home" #2: initiating Quick Mode PUBKEY+ENCRYPT+TUNNEL+PFS+UP {using isakmp#1}
112 "home" #2: STATE_QUICK_I1: initiate
002 "home" #2: sent QI2, IPsec SA established {ESP=>0x1ce5b9ae <0x0b9410e4}
004 "home" #2: STATE_QUICK_I2: sent QI2, IPsec SA established {ESP=>0x1ce5b9ae <0x0b9410e4}


TEST

carol# ipsec status | grep 'STATE_MAIN_I4 (ISAKMP SA established)' [YES]
000 #1: "home" STATE_MAIN_I4 (ISAKMP SA established); EVENT_SA_REPLACE in 3267s; newest ISAKMP

carol# iptables -A INPUT -i eth0 -s 192.168.0.1 -j DROP | grep 'no output expected' [NO]

moon# sleep 50 | grep 'no output expected' [NO]

moon# cat /var/log/auth.log | grep 'inserting event EVENT_DPD' [YES]
Feb 27 22:49:57 moon pluto[10162]: | inserting event EVENT_DPD, timeout in 13 seconds for #2
Feb 27 22:50:10 moon pluto[10162]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Feb 27 22:50:10 moon pluto[10162]: | inserting event EVENT_DPD_TIMEOUT, timeout in 30 seconds for #1
Feb 27 22:50:20 moon pluto[10162]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Feb 27 22:50:30 moon pluto[10162]: | inserting event EVENT_DPD, timeout in 10 seconds for #2
Feb 27 22:50:40 moon pluto[10162]: | inserting event EVENT_DPD, timeout in 10 seconds for #2

moon# cat /var/log/auth.log | grep 'DPD: No response from peer - declaring peer dead' [YES]
Feb 27 22:50:40 moon pluto[10162]: "rw"[1] 192.168.0.100 #1: DPD: No response from peer - declaring peer dead

moon# cat /var/log/auth.log | grep 'DPD: Terminating all SAs using this connection' [YES]
Feb 27 22:50:40 moon pluto[10162]: "rw"[1] 192.168.0.100 #1: DPD: Terminating all SAs using this connection

moon# cat /var/log/auth.log | grep 'DPD: Clearing connection' [YES]
Feb 27 22:50:41 moon pluto[10162]: DPD: Clearing connection "rw"


POST-TEST

carol# iptables -D INPUT -i eth0 -s 192.168.0.1 -j DROP

moon# ipsec stop
Stopping strongSwan IPsec...

carol# ipsec stop
Stopping strongSwan IPsec...