I have a Strongswan installation on CentOS7 connecting to a Palo Alto router. I have no access to the config on the remote router. I want to configure two subnets on the other side - one is only a single IP. I have this config in ipsec.conf:
After starting the tunnel, I can only ping 192.168.149.199, but no hosts in 10.250.72.0/24. If I only configure the 10.250.72.0/24 subnet, ping works into it.
[root@ipsec01 strongswan]# strongswan --version
Linux strongSwan U5.4.0/K3.10.0-514.6.1.el7.x86_64
According to the manual, the comma separated notation should be correct. What configuration should I use?