From 571bca865b51a23549d5465a8f133bd398111e01 Mon Sep 17 00:00:00 2001 From: Andreas Steffen Date: Mon, 18 Jun 2007 17:50:54 +0000 Subject: added dynamic DNS scenarios --- testing/tests/ikev1/dynamic-initiator/description.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 testing/tests/ikev1/dynamic-initiator/description.txt (limited to 'testing/tests/ikev1/dynamic-initiator/description.txt') diff --git a/testing/tests/ikev1/dynamic-initiator/description.txt b/testing/tests/ikev1/dynamic-initiator/description.txt new file mode 100644 index 000000000..319ed631d --- /dev/null +++ b/testing/tests/ikev1/dynamic-initiator/description.txt @@ -0,0 +1,12 @@ +The peers carol and moon both have dynamic IP addresses, so that the remote end +is defined symbolically by right=<hostname>. The ipsec starter resolves the +fully-qualified hostname into the current IP address via a DNS lookup (simulated by an +/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option +rightallowany=yes will allow an IKE main mode rekeying to arrive from an arbitrary +IP address under the condition that the peer identity remains unchanged. When this happens +the old tunnel is replaced by an IPsec connection to the new origin. +

+In this scenario carol first initiates a tunnel to moon. After some time carol +suddenly changes her IP address and restarts the connection to moon without deleting the +old tunnel first (simulated by iptables blocking IKE packets to and from +carol and starting the connection from host dave using carol's identity). -- cgit v1.2.3