Hi group, For many years I have used the trick of running a GRE or GIF tunnel encrypted with IPSec transport mode, both on FreeBSD and Linux. That allows me to run BGP or OSPF on the tunnels.
I am also aware of IPsec tunnel mode which kind of works for me, although is not my personal choice. Both modes of operation seem quite straightforward. Yet for a reason beyond my understanding FreeBSD handbook proposes a 3rd mode: using a GIF tunnel together with IPSec tunnel mode. I really don't understand how is that supposed to work. People On The Internet also seem not to be able to understand the reasoning behind such solution. Since IPSec stack provides its own encapsulation in tunnel mode, packets coming to a router would never reach the GIF interface and would never be encapsulated by it. Same for packets received, they would be deencapsulated by IPsec stack and reinjected with internal IP addresses on a public interface of router or they would appear on enc0 interface if it is in use. Am I wrong? Or is the Handbook wrong? -- | pozdrawiam / greetings | powered by Debian, FreeBSD and CentOS | | Kajetan Staszkiewicz | jabber,email: vegeta()tuxpowered net | | Vegeta | www: http://vegeta.tuxpowered.net | `------------------------^---------------------------------------'
signature.asc
Description: This is a digitally signed message part.
