/testing/guestbin/swan-prep
west #
 cp policies/* /etc/ipsec.d/policies/
west #
 echo "192.1.2.0/24"  >> /etc/ipsec.d/policies/private-or-clear
west #
 ipsec start
Redirecting to: [initsystem]
west #
 ../../guestbin/wait-until-pluto-started
west #
 # give OE policies time to load
west #
 ../../guestbin/wait-for.sh --match 'loaded 2, routed 1, active 0' -- ipsec auto --status
Total IPsec connections: loaded 2, routed 1, active 0
west #
 # lost interface with no connection
west #
 # now loose the interface 192.1.2.0/24
west #
 ifconfig eth1 down
west #
 ipsec listen
listening for IKE messages
shutting down interface eth1 192.1.2.45:4500
shutting down interface eth1 192.1.2.45:500
"private-or-clear#192.1.2.0/24": "unroute" output: RTNETLINK answers: Network is unreachable
"private-or-clear#192.1.2.0/24": "unroute" output: RTNETLINK answers: Network is unreachable
loading secrets from "/etc/ipsec.secrets"
west #
 # restore eth1
west #
 ifconfig eth1 192.1.2.45 up
west #
 ipsec listen
listening for IKE messages
adding interface eth1 192.1.2.45:UDP/500
adding interface eth1 192.1.2.45:UDP/4500 (NAT)
"private-or-clear": oriented IKEv2 connection (local: left=%defaultroute  remote: right=%opportunisticgroup)
loading secrets from "/etc/ipsec.secrets"
loading group "/etc/ipsec.d/policies/private-or-clear"
west #
 # bring up OE
west #
 ipsec whack --trafficstatus
west #
 ../../guestbin/ping-once.sh --fire-and-forget -I 192.1.2.45 192.1.2.23
fired and forgotten
west #
 ../../guestbin/wait-for.sh --match 192.1.2.23 -- ipsec whack --trafficstatus
#2: "private-or-clear#192.1.2.0/24"[1] ...192.1.2.23, type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='ID_NULL'
west #
 ../../guestbin/ping-once.sh --up   -I 192.1.2.45 192.1.2.23
up
west #
 ipsec whack --trafficstatus
#2: "private-or-clear#192.1.2.0/24"[1] ...192.1.2.23, type=ESP, add_time=1234567890, inBytes=84, outBytes=84, maxBytes=2^63B, id='ID_NULL'
west #
 # lost interface with OE connection
west #
 # now loose the interface 192.1.2.0/24
west #
 ifconfig eth1 down
west #
 ipsec listen
listening for IKE messages
shutting down interface eth1 192.1.2.45:4500
shutting down interface eth1 192.1.2.45:500
"private-or-clear#192.1.2.0/24"[1] ...192.1.2.23: terminating SAs using this connection
"private-or-clear#192.1.2.0/24"[1] ...192.1.2.23 #1: deleting IKE SA (ESTABLISHED_IKE_SA) and sending notification
ERROR: "private-or-clear#192.1.2.0/24"[1] ...192.1.2.23 #1: send on eth1 from 192.1.2.45:500 to 192.1.2.23:500 using UDP failed in delete notification: Network is unreachable (errno 101)
"private-or-clear#192.1.2.0/24"[1] ...192.1.2.23 #2: "unroute" output: RTNETLINK answers: Network is unreachable
"private-or-clear#192.1.2.0/24"[1] ...192.1.2.23 #2: "unroute" output: RTNETLINK answers: Network is unreachable
"private-or-clear#192.1.2.0/24"[1] ...192.1.2.23 #2: ESP traffic information: in=84B out=84B
"private-or-clear#192.1.2.0/24": "unroute" output: RTNETLINK answers: Network is unreachable
"private-or-clear#192.1.2.0/24": "unroute" output: RTNETLINK answers: Network is unreachable
loading secrets from "/etc/ipsec.secrets"
west #
 # restore eth1
west #
 ifconfig eth1 192.1.2.45 up
west #
 ipsec listen
listening for IKE messages
adding interface eth1 192.1.2.45:UDP/500
adding interface eth1 192.1.2.45:UDP/4500 (NAT)
"private-or-clear": oriented IKEv2 connection (local: left=%defaultroute  remote: right=%opportunisticgroup)
loading secrets from "/etc/ipsec.secrets"
loading group "/etc/ipsec.d/policies/private-or-clear"
west #
 # bring up OE
west #
 ipsec whack --trafficstatus
west #
 ../../guestbin/ping-once.sh --fire-and-forget -I 192.1.2.45 192.1.2.23
fired and forgotten
west #
 ../../guestbin/wait-for.sh --match 192.1.2.23 -- ipsec whack --trafficstatus
timeout waiting 30 seconds for ipsec whack --trafficstatus to match 192.1.2.23
output: 
west #
 ../../guestbin/ping-once.sh --fire-and-forget -I 192.1.2.45 192.1.2.23
fired and forgotten
west #
 ../../guestbin/wait-for.sh --match 192.1.2.23 -- ipsec whack --trafficstatus
#4: "private-or-clear#192.1.2.0/24"[1] ...192.1.2.23, type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='ID_NULL'
west #
 ipsec whack --trafficstatus
#4: "private-or-clear#192.1.2.0/24"[1] ...192.1.2.23, type=ESP, add_time=1234567890, inBytes=0, outBytes=0, maxBytes=2^63B, id='ID_NULL'
west #
 ../../guestbin/ping-once.sh --up   -I 192.1.2.45 192.1.2.23
up
west #
