Andreas Steffen
7c5a2974b9
For documentation purposes the new folders ikev1-algs, ikev2-algs, ikev1-multi-ca and ikev2-multi-ca have been created. Most of the test cases have now been converted to the vici interface. The remaining legacy stroke scenarios yet to be converted have been put into the ikev2-stroke-bye folder. For documentation purposes some legacy stroke scenarios will be kept in the ikev1-stroke, ikev2-stroke and ipv6-stroke folders.
15 lines
1.0 KiB
Plaintext
15 lines
1.0 KiB
Plaintext
The roadwarriors <b>carol</b> and <b>dave</b> both set up a connection to gateway <b>moon</b>.
|
|
The roadwarriors each unilaterally define a static virtual IP using the <b>leftsourceip</b>
|
|
parameter. In order to detect potential address conflicts, the roadwarriors send
|
|
their virtual IPs embedded in a configuration payload to <b>moon</b> for verification.
|
|
In our scenario <b>moon</b> accepts the address choices thus allowing <b>carol</b> and
|
|
<b>dave</b> to install their respective virtual IP addresses.
|
|
<p>
|
|
In order to test the tunnels both <b>carol</b> and <b>dave</b> ping the client <b>alice</b>
|
|
behind the gateway <b>moon</b> as well as the inner interface of the gateway.
|
|
The latter ping requires access to the gateway itself which is granted by the
|
|
directive <b>lefthostaccess=yes</b>. The source IP of the two pings will be the virtual
|
|
IP addresses <b>carol1</b> and <b>dave1</b>, respectively. Also thanks to the automatically
|
|
configured source route entries, <b>moon</b> is able to ping both roadwarriors by using the
|
|
established net-net IPsec tunnels.
|