Tunnel status in case of NAT before IPSec
the status of the Phase2 is reported as down in case of NAT before IPSec, while the tunnel is up and working properly.
The SPD entries look like (Source, Destination, Direction):
- Remote network, Local natted network, >
- Local non-natted network, Remote network, <
Looking at the code, the Phase2 is reported down because the entries are not "specular" (natted/not natted).
Updated by Michele Di Maria over 8 years ago
Since the SPD entries are not specular, in stead of searching for the "in" entry, we could look for the "out" entry, which is the same for natted/not natted entries... in this case the tunnel is reported as working.
To do that, we should change in /etc/inc/ipsec.inc the line 357 to:
else if (!empty($ph2ent['natlocalid']) && ipsec_lookup_ipsec_sa($spd,$sad,"out",$loc_ip,$rmt_ip,$loc_id,$rmt_id))
Chris, if you think this is not a problem I can change it on GitHub...