strongSwan KVM Tests / ikev2 / rw-cert-multi-ke
Test ikev2/rw-cert-multi-ke
Description
The roadwarriors carol and dave set up a connection each to gateway moon. The authentication is based on X.509 certificates. To test multiple key exchanges (RFC 9370) and IKE_INTERMEDIATE exchanges (RFC 9242), carol proposes MODP_2048 for the key exchange and CURVE_25519 for the additional key exchange whereas dave proposes MODP_3072 and ECP_384, respectively. The IKE and ESP SAs are then rekeyed using the same proposals. One set of SAs is rekeyed from carol and another from moon. Upon the successful establishment of the IPsec tunnels, the updown script automatically inserts iptables-based firewall rules that let pass the tunneled traffic. In order to test both tunnel and firewall, both carol and dave ping the client alice behind the gateway moon.