csedgbeer.siemens wrote:
neither appear to work, the main vpn comes up but not with the 2nd subnet, wonder if anyone has tried this and got it working?
[I've only used multiple subnets with the "More" option (Draytek-to-Draytek)...]
Have you seen:
https://draytek.co.uk/support/guides/kb-vpn-multiplesa
?
Draytek wrote:
To add access through the VPN for the second subnet, select the More and add the details of the second subnet. The "Create Phase 2 SA for each subnet does not need to be ticked unless one of the site is non-DrayTek router which requires any traffic to exactly match the IPSEC security association. If the device (eg a Cisco) requires traffic to match the security assocation then a Phase 2 SA must be created for each subnet. In this case, enable the Create Phase2 SA for each subnet.(IPsec) option.
So you may need to ascertain Strongswan's requirements first.
and
Draytek wrote:
If Create Phase2 SA for each subnet.(IPsec) is unticked then [Connection Management] will show one VPN tunnel for the link and more subnets will be listed in the routing table. If the Create Phase2 SA for each subnet.(IPsec) is ticked then each subnet will appear in [Connection Management] with the same profile name.
Without the "Create Phase2..." option enabled, the entry in [Connection Management] doesn't change...
Are you sure it's not a Routing issue (maybe at the client, that's trying to access the new subnet)
