Hi Joy, >>I am working on setting up Labeled IPsec along with iptables nat >>rules. Once I insert nat related rules, the ipsec connection breaks >>and the system tries to re-negotiate and creates multiple SAs. I am >>using 2.6.19 kernel (with Venkat's MLSXFRM patches & bugfixes). I >>guess those were incorporated into the 2.6.20 kernel. > > Are you using racoon in ipsec-tools to create labeled SAs? > If so, I recall seeing duplicate SA pairs being created > while using racoon for labeled ipsec. We determined userspace > should manage this. > I posted a patch to ipsec-tools, but I don't think they > ever picked it up... I do not know if this is same problem, > but you could give it a try.
Thanks for replying. I am using racoon for testing. I searched for your patch in the ipsec-tools, but couldn't find it. It would be helpful if you could point me to the patch. The reason I was debugging the kernel is because I was under the assumption that the kernel should not invoke racoon if a matching SA is available in the SAD (like in my case). Thanks Yogesh -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html
