denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: Describe the tunneling of several subnets with IKEv1 in more detail

Browse Source
This commit is contained in:
Noel Kuntze
2017-03-23 18:26:54 +01:00
committed by Tobias Brunner
parent c055c7013e
commit 11ebba0042
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+3 -1
View File
@@ -913,7 +913,9 @@ the greatest common subnet. In IKEv1, this may lead to problems with other
implementations, make sure to configure identical subnets in such
configurations. IKEv2 supports multiple subnets separated by commas. IKEv1 only
interprets the first subnet of such a definition, unless the Cisco Unity
extension plugin is enabled.
extension plugin is enabled. This is due to a limitation of the IKEv1 protocol,
which only allows a single pair of subnets per CHILD_SA. So to tunnel several
subnets a conn entry has to be defined and brought up for each pair of subnets.
The optional part after each subnet enclosed in square brackets specifies a
protocol/port to restrict the selector for that subnet.