StrongSwan: multiple rightsubnet using IKEv1

site-to-site-vpnstrongswanvigorvpn

https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection

According to strongSwan documentation rightsubnet with multiple network addresses only works with IKEv2. There is a common (?) workaround, to set up multiple connections, all using the same SA.
Our scenario is that we use a Vigor 2860 as the company VPN gateway where all home offices etc connect to.

If I setup multiple connections in strongSwan I would need to define multiple LAN-to-LAN profiles in the Vigor. Depending on the home offices to connect this would exceed the number of profiles.

Is there another workaround to achieve traffic to a 2nd subnet being sent through the tunnel? (Routing? NATing?)

Thanks in advance.

Best Answer

If you only need resources behind Vigor available for VPN access from dial-in clients, you should use NAT on the client side when connecting to the gateway, and likely use L2TP/IPsec in transport mode to set up connections. This way your home offices' gateways would connect to the central hub, get IP addresses from the pool configured in xl2tpd, and be able to access resources in same VPN or other routed networks.

If you need to link any two home offices via these VPNs, perhaps it'll be better if you use a different hub endpoint than Vigor, up to another Strongswan installation with VPN passthrough enabled on Vigor for that machine, and not bother about that device's profile limits.

Related Solutions

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

Yes, you can do IKEv1 and IKEv2 simultaneously as long as you have both pluto and charon installed and the daemons running. Use this in your config setup:

charonstart=yes
plutostart=yes

And use the keyexchange parameters in your ipsec.conf's conn sections:

conn foo
  ...
  keyexchange=ikev2
  ...

conn bar
  ...
  keyexchange=ikev1
  ...

Two tunnels with same rightsubnet for StrongSWAN/OpenSWAN

As you may noticed in option 1 and option 2 of the increasing VPN throughput article, the Compute Engine VPN gateway or network automatically load balance the traffic to Peer VPN gateway(s).

For options 3, you will need to create a cluster of your VPN gateways to run load balancing for your IPsec VPN gateways.

As you mentioned this can be done using load sharing cluster feature of the StrongSwan or you can setup a load balancer (like HAProxy) to distributes workloads from your remote network across peer VPN gateways.

Best Answer

Related Solutions

Simultaneous IKEv1 and IKEv2 connection support in Strongswan

Two tunnels with same rightsubnet for StrongSWAN/OpenSWAN

Related Topic