Multiple selectors

More than one network

Lesson 9 of 20 · 11 min · Module 3: Real networks

Offices grow. The day a second network appears behind a gateway, the tunnel that worked for years carries only half the traffic.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Add a selector for an additional network
Explain why both gateways must change
Check each pair of networks separately

The idea

A selector covers one pair of networks. A second local network needs a second selector, and the peer needs its mirror image. Each pair gets its own child SA. Until both sides are updated, traffic from the new network matches nothing and is dropped.

selector 10.0.1.0/24 10.1.0.0/24
selector 10.0.8.0/24 10.1.0.0/24

01One child SA per pair

With two local networks and one remote network there are two pairs, so two selectors and two child SAs. They are negotiated separately: one can be installed while the other is refused.

02Summarise only when it is true

Writing 10.0.0.0/16 instead of two /24 lines is shorter, but it claims 254 networks that are not yours. Summarise when the networks really are one block that both sides agree on; otherwise list them.

03Several networks on real devices

FortiGate uses one phase 2 entry per pair, or address groups. ACL-based devices add a line per pair.

# FortiGate: a second phase 2 on the same phase 1
config vpn ipsec phase2-interface
    edit "to-branch-lab"
        set phase1name "to-branch"
        set src-subnet 10.0.3.0 255.255.255.0
        set dst-subnet 10.1.0.0 255.255.255.0
    next
end

# Huawei USG: another rule in the same ACL
acl number 3000
 rule 10 permit ip source 10.0.3.0 0.0.0.255 destination 10.1.0.0 0.0.0.255

# Cisco IOS
ip access-list extended VPN-TRAFFIC
 permit ip 10.0.3.0 0.0.0.255 10.1.0.0 0.0.0.255

Your turn

The head office has a second network, the lab network 10.0.3.0/24, which also needs the branch (10.1.0.0/24). The branch administrator has already added it. Add the selector on this side. Keep the existing one, and do not summarise the two networks.

What the checks look for

The office network still reaches the branch
The lab network reaches the branch, in both directions
Two selectors are installed, as configured
The networks are listed, not summarised

Try it in the editor →

Take this with you

One selector per pair of networks, on both gateways. Check every pair after a change, not only the tunnel status.

Go a little further

Replace both selectors with a single "selector 10.0.0.0/16 10.1.0.0/24" and run the lab. Read the word "narrowed" in the Output tab; the next lesson is about it.