strongSwan KVM Tests / ikev2 / net2net-rfc3779
Test ikev2/net2net-rfc3779
Description
A connection between the subnets behind the gateways moon and sun is set up. The authentication is based on X.509 certificates containing RFC 3779 IP address block constraints. Both moon and sun set remote_ts = 0.0.0.0/0 thus allowing the peers to narrow down the address range to their actual subnets 10.1.0.0/16 and 10.2.0.0/16, respectively. These unilaterally proposed traffic selectors must be validated by corresponding IP address block constraints. In addition to that moon sets its local subnet to 10.0.0.0/14 but which is automatically narrowed down to 10.1.0.0/16 by sun matching it to the IP address constraint in moon's certificate. Upon the successful establishment of the IPsec tunnel, the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, client alice behind gateway moon pings client bob located behind gateway sun.