Strongswan to Cisco ASA with multiple right subnet
Solution 1:
The answer is simple, Cisco ASAs don't support multiple traffic selectors per CHILD_SA. So you have to negotiate individual CHILD_SAs for each combination of local and remote subnet you want to tunnel. That is, something like:
conn host2
...
rightsubnet=192.168.1.0/24
...
conn host2-2
also=host2
rightsubnet=192.168.2.0/24
conn host2-3
also=host2
rightsubnet=192.168.3.0/24