Dennis Pedersen wrote: >>Setting up the other approach (IPIP tunnel + IPsec transport mode) works >>by first setting up the tunnels (see the gifconfig/ifconfig man pages) >>and stringing the topology together with route (route man page). No >>other commands are needed. Once this works (i.e. you see correctly >>encapsulated packets flow between your machines) you can then manually >>configure IPsec transport mode SAs (via setkey) or use IKE. > > But the last document where the auther creates some alias to lo0 and runs > natd on the gif interface isnt that the right way of doing it (lets just > forget ipsec for now and look stricktly on IPIP) or?
The alias on loopback is simply working around a small bug with gif
interfaces. (Normally you can ping the local address of a any interface;
with KAME gifs you can't. The alias works around that.)
NAT is not required to make the overlay setup work. (The example you
gave includes it so that overlay nodes with RFC1918 addresses can talk
to the real Internet. This is an orthogonal issue.)
> According to what you are writing this isnt the way of doing it? (and there
> you seem to have lost me..)
There are TWO ways of doing this:
1. IPsec tunnel mode
- you don't need any gifs
- you must use IPsec selectors to match & forward your traffic
2. IPIP tunnels + transport mode
- you do need gifs but ONLY with IPsec TRANSPORT mode SAs
- you use regular routes to forward your traffic
Pick one.
> About the Kame Newsletters i belive to have read all of them that have
> relevance of ĪPsec, anything specifik im missing?
Configuring KAME for IPsec: manual keying
http://www.kame.net/newsletter/19980626/
Simple Configuration Sample of IPsec/Racoon
http://www.kame.net/newsletter/20001119/
Changed manual key configuration for IPsec
http://www.kame.net/newsletter/19991007/
Lars
--
Lars Eggert <[EMAIL PROTECTED]> Information Sciences Institute
http://www.isi.edu/larse/ University of Southern California
smime.p7s
Description: S/MIME Cryptographic Signature
