OpenSwan -> Pix VPN, Multiple subnets?

S

Stinn

[H]ard|Gawd
Joined
Jul 13, 2001
Messages
1,796
In PixLand you can define multiple subnets on either side of the vpn. Something like this:


access-list acl-nat0 extended permit ip 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0
access-list acl-nat0 extended permit ip 3.3.3.0 255.255.255.0 2.2.2.0 255.255.255.0

access-list cryptomap-1 extended permit ip 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0
access-list cryptomap-1 extended permit ip 3.3.3.0 255.255.255.0 2.2.2.0 255.255.255.0

Well I have an IPCop box on the far end that works fine, as long as I only want 1.1.1.0/24 to go across. Now I want to set it up so 3.3.3.0/24 goes across as well. The pix side is easy but as far as I can tell, and been told by someone, you have to have a different tunnel for each set of networks for openswan. Now does this mean I just need to setup the ipsec.conf like this:

Code: 
conn myvpn
        left=10.10.10.10
        leftnexthop=%defaultroute
        leftsubnet=2.2.2.0/255.255.255.0
        right=11.11.11.11
        rightsubnet=1.1.1.0/255.255.255.0
        rightnexthop=%defaultroute
        

conn myvpn2
        left=10.10.10.10
        leftnexthop=%defaultroute
        leftsubnet=2.2.2.0/255.255.255.0
        right=11.11.11.11
        rightsubnet=3.3.3.0/255.255.255.0
        rightnexthop=%defaultroute
Can I do that? Any advice would be appreciated.
 
In case anyone is ever looking for this answer, yes that is what you do. I got it working this morning.
 
Glad you got your answer. Now let me tell you how much of a pig openswan is. No, strike that,let me just tell you that if you can, switch to openvpn. It's a far more robust solution than openswan ever was, and it "just works". Additionally, it adds a trivial amount of latency to the connection ( unlike openswan ). Less than 5ms, typically less than 1ms.
 
You must log in or register to reply here.
Back
Top