On Fri, Aug 18, 2006 at 11:59:39AM +0200, Remko Lodder wrote:
> Ofcourse I should do the [1] trick:
>
> I want to do the following; I have three IPsec endpoints
> at this moment, one at home, one in my personal colo environment
> and one in another colo environment.
>
> The machine(s) in the personal colo environment are the point
> to where all the others connect to. So the other colo env
> connects to the personal colo environment, and my home also
> connects to the personal colo environment.
>
> I would like to be able to:
>
> Other colo -- ipsec tunnel -- personal colo -- ipsec -- home
>
> Have these communications possible, and ofcourse the other way
> around. In the event that another tunnel will be attaching,
> I would like to be able to route these packets to the other
> host as well (so that I can reach all the IPsec tunneled hosts
> from the IPsec network, from where-ever I will be, either road
> -warrior, or just at home, or at one of the colo machine's).
That's fine, you just have to set up your SA's properly. For example, if you
are using 10.* private addresses everywhere, then on the 'spoke' machines
you set up an SA that looks like
10.0.1.0/24 -> 10.0.0.0/8
(if 10.0.1.0/24 is the address range assigned to this particular client).
All other 10.* addresses will be routed down the tunnel.
Or, you can always set up multiple SAs. e.g. at the 'other colo' side you
could set up SAs for
10.0.1.0/24 -> 10.0.2.0/24
10.0.1.0/24 -> 10.0.3.0/24
both with a tunnel IP of the 'personal colo' server. Here, I'm assuming that
10.0.2.0/24 is the 'personal colo' space, and 10.0.3.0/24 is the 'home'
space.
Regards,
Brian.
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
