Re: [IPsec] Can one IPsec SA be established via two internet ports on one device?

[Paul Wouters <[e-mail]>]

On Mon, 19 Nov 2018, Linda Dunbar wrote:

> When you said “IPs are sourced loopbacks that are part of a prefix exported to the the isp(s) in each site”,
> do you mean that the private Loopback addresses of CPE1 & CPE2 are routable in all four  ISPs’ that
> connected to A1, A2, B1, B2?

And to clarify, assuming your IPsec connection does not cover the IPs
used on both endpoints, but instead is some kind of subnet behind your
servers, then you can one IPsec SA. It does require some tricks if you
really want to limit it to one IPsec SA.

Remember that while you can choose which outgoing interface to use,
you cannot choose the incoming device, so it would be a poor load balance.

It is far easier to use two IPsec SA's that cover the same site-to-site
range.

On Linux, the easiest would be to setup two identical subnet-to-subnet
IPsec SA with a different XFRM mark. Then create a VTI device for each
of these. Then you can use routing and traffic shaping/control to send
packets to one or the other VTI interface for load balancing. If one of
the links goes down, the interface goes down and it all goes over the
remaining interace. Libreswan and strongswan support this. For
libreswan, use:

conn one
 	[basic config]
 	mark=8/0xffffffff
 	vti-interface=ispA
 	vti-routing=no
 	vti-shared=no
conn two
 	[basic config]
 	mark=7/0xffffffff
 	vti-interface=ispB
 	vti-routing=no
 	vti-shared=no

Then handle the routing/traffic control yourself.

Another solution for this is using MOBIKE, but then you are only using
one of the two in a failover type of scenario, and it is not doing any
kind of load balancing. Again libreswan and strongswan support this.

Paul