> Le 12 juil. 2018 à 15:43, Jean-Daniel Dupas <jddu...@xooloo.com> a écrit :
>
> Hello,
>
> I'm trying to setup an active-active HA cluster. Actually, I'm close to have
> a full working setup, but I have a blocking issue.
>
> I have installed a custom kernel (4.15.x family), and setup the CLUSTERIP as
> described in the HA guide (
> https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability )
>
> Both my nodes receive the traffic, and they properly managed the cluster IP
> to handle only half of the packets.
> When I'm establishing a session, only one node handle it (as expected), and
> the other one setup a passive IKE_SA.
>
> My problem is that once the session is up, sometimes, this is the passive
> node (for that session) that takes over the IPSec traffic and the active node
> completely ignore it.
> If I sniff the incoming traffic (tcpdump), the decrypted traffic is only
> detected on the node that setup a passive IKE_SA, and not on the node with
> the active IKE_SA.
>
> To make it clear, telling I have 2 servers: Alice and Moon. The IKE session
> is established on moon, and a passive session is created on Alice, but then
> the decrypted traffic only show up on Alice.
> As Alice is a passive node and don't have iptables entry and routes created
> to handle that traffic, it rejects it (as expected).
>
> Does anyone know what can cause that inconsistency ?
>
> My iptable rules look like this:
>
> -A INPUT -i enp1s1 -d 1.2.3.4 -j CLUSTERIP --new --hashmode sourceip
> --clustermac 01:00:5e:00:00:20 --total-nodes 2 --local-node 0
>
> I don't think this is relevant, but I'm using strongswan systemd 5.6.2
> (swanctl) on Ubuntu 18.04.
>
> Thanks
I found an hint in the swanctl logs:
07[CFG] installed HA CHILD_SA net{3} 0.0.0.0/0 ::/0 === 10.192.3.3/32 (segment
in: 2*, out: 1)
strongswan explicitly choose different segments for input and output. The
segment where the connection was established here is the segment 1.
As it defines segment 2 for input traffic, it obviously does not works. Is
there some settings to force strongswan to always use the segment who own the
connection for input and output traffic ?
