diff options
Diffstat (limited to 'testing/tests/ikev1/virtual-ip/description.txt')
| -rw-r--r-- | testing/tests/ikev1/virtual-ip/description.txt | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/testing/tests/ikev1/virtual-ip/description.txt b/testing/tests/ikev1/virtual-ip/description.txt index 4ec6021ea..c16b70b70 100644 --- a/testing/tests/ikev1/virtual-ip/description.txt +++ b/testing/tests/ikev1/virtual-ip/description.txt @@ -1,8 +1,14 @@ -The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>. Both <b>carol</b> -and <b>moon</b> define a static virtual IP using the <b>leftsourceip</b> parameter. -<b>leftfirewall=yes</b> automatically inserts iptables-based firewall rules that let pass -the tunneled traffic. In order to test the tunnel, <b>carol</b> pings the client <b>alice</b> -behind the gateway <b>moon</b> as well as the inner interface of the gateway. The source IP -of the two pings will be the virtual IP <b>carol1</b>. Also thanks to its virtual IP <b>moon1</b> -the gateway <b>moon</b> is able to ping <b>carol1</b> by using the existing subnet-subnet IPsec -tunnel. +The roadwarriors <b>carol</b> and <b>dave</b> both set up a connection to gateway <b>moon</b>. +The roadwarriors each unilaterally define a static virtual IP using the <b>leftsourceip</b> +parameter. In order to detect potential address conflicts, the roadwarriors send +their virtual IPs embedded in an IKEv1 Mode Config payload to <b>moon</b> for verification. +In our scenario <b>moon</b> accepts the address choices thus allowing <b>carol</b> and +<b>dave</b> to install their respective virtual IP addresses. +<p> +In order to test the tunnels both <b>carol</b> and <b>dave</b> ping the client <b>alice</b> +behind the gateway <b>moon</b> as well as the inner interface of the gateway. +The latter ping requires access to the gateway itself which is granted by the +directive <b>lefthostaccess=yes</b>. The source IP of the two pings will be the virtual +IP addresses <b>carol1</b> and <b>dave1</b>, respectively. Also thanks to the automatically +configured source route entries, <b>moon</b> is able to ping both roadwarriors by using the +established net-net IPsec tunnels. |