strongSwan KVM Tests / ikev2 / host2host-transport-nat
Test ikev2/host2host-transport-nat
Description
An IPsec transport-mode connection between the natted host alice and gateway sun is successfully set up. The updown script automatically inserts iptables-based firewall rules that let pass the protected traffic. In order to test the host-to-host tunnel alice pings sun.Note: This scenario also demonstrates two problems with transport-mode and NAT traversal:
- The client venus behind the same NAT as client alice is not able to ping sun (even with ICMP explicitly allowed there) because the request arrives unencrypted and thus gets dropped when the IPsec policies are consulted (increases the XfrmInTmplMismatch counter in /proc/net/xfrm_stat).
- A similar issue arises when venus also establishes an IPsec transport-mode connection to sun. Due to the conflicting IPsec policies sun will use the newer SA from venus to send traffic to the common transport mode address.
