Re: Greedy match of traffic in iked between site and hub

2023-10-16 Thread Stuart Henderson
On 2023-10-16, rea...@catastrophe.net wrote: > On Sun, Oct 15, 2023 at 04:56:17PM -, Stuart Henderson wrote: >>On 2023-10-15, rea...@catastrophe.net wrote: >>> What is a better way to configure iked on site-obsd so that it does not >>> encapsulate local traffic on the 10.89.2.0/24 network? Ob

Re: Greedy match of traffic in iked between site and hub

2023-10-15 Thread readme
On Sun, Oct 15, 2023 at 04:56:17PM -, Stuart Henderson wrote: >On 2023-10-15, rea...@catastrophe.net wrote: >> What is a better way to configure iked on site-obsd so that it does not >> encapsulate local traffic on the 10.89.2.0/24 network? Obviously my >> understanding is incorrect, so any he

Re: Greedy match of traffic in iked between site and hub

2023-10-15 Thread Hrvoje Popovski
On 15.10.2023. 18:56, Stuart Henderson wrote: > On 2023-10-15, rea...@catastrophe.net wrote: >> What is a better way to configure iked on site-obsd so that it does not >> encapsulate local traffic on the 10.89.2.0/24 network? Obviously my >> understanding is incorrect, so any help is appreciated.

Re: Greedy match of traffic in iked between site and hub

2023-10-15 Thread Stuart Henderson
On 2023-10-15, rea...@catastrophe.net wrote: > What is a better way to configure iked on site-obsd so that it does not > encapsulate local traffic on the 10.89.2.0/24 network? Obviously my > understanding is incorrect, so any help is appreciated. You should be able to add a bypass flow in ipsec.c

Re: Greedy match of traffic in iked between site and hub

2023-10-15 Thread readme
On Sun, Oct 15, 2023 at 09:15:07AM -0500, rea...@catastrophe.net wrote: [..] Some numbers got transposed in this message. All the devices are truly on 10.99.2.0/24 (even when 10.89.2 was in the original email) >site-obsd# ping -qc2 r1 >PING r1 (10.89.2.1): 56 data bytes 10.99.2.1

Greedy match of traffic in iked between site and hub

2023-10-15 Thread readme
Greetings - I have a hub that is terminating IPsec connections from various sites. One site is running 7.3 and has downlinks to other routers on vlan2. When I try and ping from the site-obsd (the OpenBSD machine at site) to the router, there are no issues and that device is getting DHCP addresses