At 14:20 8-4-2002 -0700, Lars Eggert wrote:
>There are no IPsec tunnel devices in KAME. IPsec defines "security
>associations" (SAs), which are not represented as devices in the routing
>table in KAME. Thus, you can't use routes to direct traffic into these
>tunnel mode SAs, you need to set up your security policies with the
>correct selectors (think firewall-like matching).
>
>*Many* tutorials on the net do not understand this disctinction, and
>tell you to set up an IPIP tunnel (using a gif) and an IPsec tunnel
>mode SA in parallel. This is a bad hack, since you (ab)use a side effect
>of creating an IPIP tunnel device (it can be used for route entries) to
>redirect traffic into your (separate) tunnel mode SA. Very roughly, you
>set up the IPIP tunnel, then yank out the packets destined for it during 
>outbound processing and force them over an IPsec tunnel mode SA.
>
>Use EITHER IPsec tunnel mode alone OR IPIP tunnels and IP transport
>mode (draft-touch-ipsec-vpn). Mixing both can work in some scenarios where 
>the dependencies between side effects are just right, but in general, it's 
>a broken approach.

Well see, nowhere does it say how to actually do IPsec tunnel mode VPN from 
between 2 internet hosts.

I just got the VPN connection to the Watchguard Firebox working using IPIP 
& IPsec tunnel mode.

There's a few quirks with ipfw and something odd with setting things up 
while a ping to a remote private host is going, but it's working fine 
otherwise.

I'd like to hear how to do it the proper way though. Feel like clueing me in?

         Doc


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-net" in the body of the message

Reply via email to