Routing between IPSEC tunnels, additional subnets?

Well, it would appear that I have posted too soon.  After some more digging at the frees/wan project site, I found the exact scenario I am having, as well as the suggested config.  For the benefit of anybody else running into this issue, I will post the suggested config. This is straight from the project site at:  

http://www.freeswan.org/freeswan_trees/freeswan-2.06/doc/adv_config.html#adv_config

Here is the text of the site:

----------------------------------------
For example, one user recently asked on a mailing list about this network configuration:

        netA---gwA---gwB---netB
                            |----netC

   netA and B are secured netC not.
   netA and gwA can not access netC

The user had constructed only one tunnel, netA to netB, and wanted to know how to use ip-route to get netC packets into it. This is entirely unnecessary. One of the replies was:

  The simplest way and indeed the right way to
  solve this problem is to set up two connections:

        leftsubnet=NetA
        left=gwA
        right=gwB
        rightsubnet=NetB
  and
        leftsubnet=NetA
        left=gwA
        right=gwB
        rightsubnet=NetC

This would still be correct even if we added nets D, E, F, ... to the above diagram and needed twenty tunnels.

-------------------------------------

So, it would appear that in order to get additional subnets working, you should create another  tunnel with the additional subnet as the "remote subnet" within the IPSEC connection config.  I have done this and have not yet been able to get it to work (im still trying to route between tunnels, not just an additional subnet behind the firewall), but this may answer the question for somebody else.  

If anyone else has anything to add to this, it would be of great interest.  =)

Quick followup post:

The routing between the two IPSEC tunnels is now working, using the solution I posted previously.  This is definitely the solution for anybody else in the same situation, although for any situation with multiple endpoints and multiple subnets behind each endpoint, or just the need for any ipsec endpoint to reach any other ipsec endpoint, this solution scales very very badly.  Any new endpoint will require an additional tunnel on that endpoint for each pre-existing endpoint , as well as on all of the other endpoints.  

Can anyone say...nightmare?  A solution allowing one to simply add a route to a remote gw (only reachable via the tunnel) would be much more elegant, as well as simple in regards to administration.  This does not seem to be possible with frees/wan.

On the other hand, as long as the subnets on all of the remote endpoints were able to be covered beneath a single netmask (IE, all subnets were within the 10.X.X.X  reserved space), then a single tunnel would be possible, with the remote subnet in the policy being defined as 255.X.X.X.  

Ok, enough rambling.  I was just excited to finally get this working.  

 

Yes, it's a nightmare...!

 

Do you have a solution after more than 13 years?

 

We do have an IPsec tunnel between Site A and Site B with 11 networks at Site A 7 and networks at Site B.

The UTM at Site A therefore builds a tunnel with 77 SAs (11 x 7) - every local network can connect to every remote network.

 

Site B is using Watchguard and they don't want us to be able to access every network. They can configure there tunnel like...

 

Remote network A1 can access / be accessed by local network B1, B3

Remote network A2 can access / be accessed by local network B1, B2

 

They don't have 77 SAs and i see errors in the dashboard because of SAs with no connection.

 

For me, it would be the best to establish one tunnel between a kinf of transfer network with routing and firewall rules on both sites.

Christian, wouldn't the easiest be to have different tunnels for A1<-->B1,B3 and A2<-->B1,B2?  It seems like that would be clearer for others to follow.

Cheers - Bob