IPsec - Revision history

Duranzed: /* Troubleshoot */

2026-02-24T10:58:09Z

Troubleshoot

← Older revision		Revision as of 10:58, 24 February 2026
Line 201:		Line 201:

	== Troubleshoot ==		== Troubleshoot ==
	- '''~~sudo~~ service strongswan start''' --> Starts strongswan service.		The following commands require root priviliges, it is recommanded to use a user with sudo priviliges:
	- '''~~sudo~~ service strongswwan stop''' --> Stops strongswan service.		- '''service strongswan start''' --> Starts strongswan service.
	- '''~~sudo~~ service strongswan status''' --> Shows strongswan service.		- '''service strongswwan stop''' --> Stops strongswan service.
	- '''~~sudo~~ swanctl --load-all'''--> Loads the complete strongswan configuration from swanctl.conf.		- '''service strongswan status''' --> Shows strongswan service.
	- '''~~sudo~~ swanctl --initiate --child "child name"''' --> Initiates a connection on a specific child SA.		- '''swanctl --load-all'''--> Loads the complete strongswan configuration from swanctl.conf.
	- '''~~sudo~~ swanctl --terminate --ike "connection name"''' --> Closes an IKE SA and all of its children.		- '''swanctl --initiate --child "child name"''' --> Initiates a connection on a specific child SA.
	- '''~~sudo~~ swanctl --list-conns''' --> Lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type.		- '''swanctl --terminate --ike "connection name"''' --> Closes an IKE SA and all of its children.
	- '''~~sudo~~ swanctl --list-sas''' --> Lists SA security associations actives and shows what's established in the tunnel.		- '''swanctl --list-conns''' --> Lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type.
	- '''~~sudo~~ tcpdump -i vmx0 proto 47''' --> Captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation).		- '''swanctl --list-sas''' --> Lists SA security associations actives and shows what's established in the tunnel.
	- '''~~sudo~~ tcpdump -i vmx0 proto 50''' --> Captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload).		- '''tcpdump -i vmx0 proto 47''' --> Captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation).
	- '''~~sudo~~ tcpdunmp -i grex''' --> Captures traffic on the gre tunnel interface.		- '''tcpdump -i vmx0 proto 50''' --> Captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload).
			- '''tcpdunmp -i grex''' --> Captures traffic on the gre tunnel interface.

	Linked to {{T\|2202}}		Linked to {{T\|2202}}

Duranzed at 08:05, 19 February 2026

2026-02-19T08:05:27Z

Show changes

Duranzed: Blanked the page

2026-02-19T08:05:13Z

Blanked the page

Show changes

Duranzed: /* IPsec solution - key decision questions */

2026-02-18T14:46:05Z

IPsec solution - key decision questions

← Older revision		Revision as of 14:46, 18 February 2026
Line 186:		Line 186:
	* CLoud providers ?		* CLoud providers ?

	Architechture		Architechture:
	* Can we avoid GRE over GRE in the long term ?		* Can we avoid GRE over GRE in the long term ?
	* How many tunnels ?		* How many tunnels ?

	Stability		Stability:
	* How stable is rekeying ? Does rekeying interrupt GRE traffic ?		* How stable is rekeying ? Does rekeying interrupt GRE traffic ?
	* Any known issues with multicast over GRE ?		* Any known issues with multicast over GRE ?

Duranzed: /* IPsec solution - key decision questions */

2026-02-18T14:45:48Z

IPsec solution - key decision questions

← Older revision		Revision as of 14:45, 18 February 2026
Line 174:		Line 174:
	=== IPsec solution - key decision questions ===		=== IPsec solution - key decision questions ===

	Protocol & Cryptography		Protocol & Cryptography
	Should we use IKEv ? if yes Which IKe version to use ?		Should we use IKEv ? if yes Which IKe version to use ?
	Which encryption algorithms must be supported ?		Which encryption algorithms must be supported ?
Line 182:		Line 182:
	* EAK?		* EAK?

	Do we require interoperability ?		Do we require interoperability ?
	* Cisco devices ?		* Cisco devices ?
	* CLoud providers ?		* CLoud providers ?

	Architechture		Architechture
	* Can we avoid GRE over GRE in the long term ?		* Can we avoid GRE over GRE in the long term ?
	* How many tunnels ?		* How many tunnels ?

	Stability		Stability
	* How stable is rekeying ? Does rekeying interrupt GRE traffic ?		* How stable is rekeying ? Does rekeying interrupt GRE traffic ?
	* Any known issues with multicast over GRE ?		* Any known issues with multicast over GRE ?

Duranzed: /* IPsec solution - key decision questions */

2026-02-18T14:45:25Z

IPsec solution - key decision questions

← Older revision		Revision as of 14:45, 18 February 2026
Line 174:		Line 174:
	=== IPsec solution - key decision questions ===		=== IPsec solution - key decision questions ===

	# Protocol & Cryptography		Protocol & Cryptography
	Should we use IKEv ? if yes Which IKe version to use ?		Should we use IKEv ? if yes Which IKe version to use ?
	Which encryption algorithms must be supported ?		Which encryption algorithms must be supported ?
Line 181:		Line 181:
	* PKI?		* PKI?
	* EAK?		* EAK?
	Do we require interoperability ?
			Do we require interoperability ?
	* Cisco devices ?		* Cisco devices ?
	* CLoud providers ?		* CLoud providers ?

	# Architechture		Architechture
	* Can we avoid GRE over GRE in the long term ?		* Can we avoid GRE over GRE in the long term ?
	* How many tunnels ?		* How many tunnels ?

	# Stability		Stability
	* How stable is rekeying ? Does rekeying interrupt GRE traffic ?		* How stable is rekeying ? Does rekeying interrupt GRE traffic ?
	* Any known issues with multicast over GRE ?		* Any known issues with multicast over GRE ?

Duranzed: /* Official documentation */

2026-02-18T14:41:04Z

Official documentation

← Older revision		Revision as of 14:41, 18 February 2026
Line 195:		Line 195:

	=== Official documentation ===		=== Official documentation ===
	*[https://docs.strongswan.org/docs/latest/index.html/ StronSgwan doc]		*[https://docs.strongswan.org/docs/latest/index.html StronSgwan doc]
	*[https://libreswan.org/man/ LibreSwan doc]		*[https://libreswan.org/man/ LibreSwan doc]
	*[https://github.com/zoulasc/racoon2/ Racoon2 doc]		*[https://github.com/zoulasc/racoon2/ Racoon2 doc]

Duranzed: /* Troubleshoot */

2026-02-18T13:42:48Z

Troubleshoot

Duranzed: /* Troubleshoot */

2026-02-18T13:27:48Z

Troubleshoot

← Older revision		Revision as of 13:27, 18 February 2026
Line 200:		Line 200:

	== Troubleshoot ==		== Troubleshoot ==
			- '''sudo service strongswan start''' --> Starts strongswan service
	- '''sudo swanctl --load-all'''--> ~~loads~~ the complete strongswan configuration from swanctl.conf		- '''sudo service strongswwan stop''' --> Stops strongswan service
	- '''sudo swanctl --initiate --child "child name"''' --> ~~initiates~~ a connection on a specific child SA		- '''sudo service strongswan status''' --> Shows strongswan service
	- '''sudo swanctl --terminate --ike "connection name"''' --> ~~closes~~ an IKE SA and all of its children		- '''sudo swanctl --load-all'''--> Loads the complete strongswan configuration from swanctl.conf
	- '''sudo swanctl --list-conns''' --> ~~lists~~ all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type		- '''sudo swanctl --initiate --child "child name"''' --> Initiates a connection on a specific child SA
	- '''sudo swanctl --list-sas''' --> ~~lists~~ SA security associations actives and shows what's established in the tunnel.		- '''sudo swanctl --terminate --ike "connection name"''' --> Closes an IKE SA and all of its children
	- '''sudo tcpdump -i vmx0 proto 47''' --> ~~captures~~ traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation)		- '''sudo swanctl --list-conns''' --> Lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type
	- '''sudo tcpdump -i vmx0 proto 50''' --> ~~captures~~ traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload)		- '''sudo swanctl --list-sas''' --> Lists SA security associations actives and shows what's established in the tunnel.
			- '''sudo tcpdump -i vmx0 proto 47''' --> Captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation)
			- '''sudo tcpdump -i vmx0 proto 50''' --> Captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload)

	Linked to {{T\|2202}}		Linked to {{T\|2202}}

Duranzed: /* Troubleshoot */

2026-02-18T13:23:53Z

Troubleshoot

← Older revision		Revision as of 13:23, 18 February 2026
Line 201:		Line 201:
	== Troubleshoot ==		== Troubleshoot ==

	- sudo swanctl --load-all.--> loads the complete strongswan configuration from swanctl.conf		- '''sudo swanctl --load-all'''--> loads the complete strongswan configuration from swanctl.conf
	- sudo swanctl --initiate --child "child name" --> initiates a connection on a specific child SA		- '''sudo swanctl --initiate --child "child name"''' --> initiates a connection on a specific child SA
	- sudo swanctl --terminate --ike "connection name" --> closes an IKE SA and all of its children		- '''sudo swanctl --terminate --ike "connection name"''' --> closes an IKE SA and all of its children
	- sudo swanctl --list-conns --> lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type		- '''sudo swanctl --list-conns''' --> lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type
	- sudo swanctl --list-sas --> lists SA security associations actives and shows what's established in the tunnel.		- '''sudo swanctl --list-sas''' --> lists SA security associations actives and shows what's established in the tunnel.
	- sudo tcpdump -i vmx0 proto 47 --> captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation)		- '''sudo tcpdump -i vmx0 proto 47''' --> captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation)
	- sudo tcpdump -i vmx0 proto 50 --> captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload)		- '''sudo tcpdump -i vmx0 proto 50''' --> captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload)

	Linked to {{T\|2202}}		Linked to {{T\|2202}}

← Older revision		Revision as of 13:42, 18 February 2026
Line 200:		Line 200:

	== Troubleshoot ==		== Troubleshoot ==
	- '''sudo service strongswan start''' --> Starts strongswan service		- '''sudo service strongswan start''' --> Starts strongswan service.
	- '''sudo service strongswwan stop''' --> Stops strongswan service		- '''sudo service strongswwan stop''' --> Stops strongswan service.
	- '''sudo service strongswan status''' --> Shows strongswan service		- '''sudo service strongswan status''' --> Shows strongswan service.
	- '''sudo swanctl --load-all'''--> Loads the complete strongswan configuration from swanctl.conf		- '''sudo swanctl --load-all'''--> Loads the complete strongswan configuration from swanctl.conf.
	- '''sudo swanctl --initiate --child "child name"''' --> Initiates a connection on a specific child SA		- '''sudo swanctl --initiate --child "child name"''' --> Initiates a connection on a specific child SA.
	- '''sudo swanctl --terminate --ike "connection name"''' --> Closes an IKE SA and all of its children		- '''sudo swanctl --terminate --ike "connection name"''' --> Closes an IKE SA and all of its children.
	- '''sudo swanctl --list-conns''' --> Lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type		- '''sudo swanctl --list-conns''' --> Lists all configured connections in swanctl.conf, displays connection name, type and local addresses and remote, children and authentification type.
	- '''sudo swanctl --list-sas''' --> Lists SA security associations actives and shows what's established in the tunnel.		- '''sudo swanctl --list-sas''' --> Lists SA security associations actives and shows what's established in the tunnel.
	- '''sudo tcpdump -i vmx0 proto 47''' --> Captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation)		- '''sudo tcpdump -i vmx0 proto 47''' --> Captures traffic on vmx0 interface which uses protocol 47, which means GRE(generic routing encapsulation).
	- '''sudo tcpdump -i vmx0 proto 50''' --> Captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload)		- '''sudo tcpdump -i vmx0 proto 50''' --> Captures traffic on vmx0 interface which uses protocol 50, which means ESP(encapsulation security payload).
			- '''sudo tcpdunmp -i grex''' --> Captures traffic on the gre tunnel interface.

	Linked to {{T\|2202}}		Linked to {{T\|2202}}