Re: pf + scrub fragment reassemble + if_bridge = bad?

2007-04-07 Thread David Duchscher
On Apr 7, 2007, at 3:51 PM, Andrew Thompson wrote: On Sat, Apr 07, 2007 at 03:01:09PM -0500, David Duchscher wrote: Ran into a problem the other day and wanted to drop a note and see if I should followup with a PR. Running a box as a bridging firewall and ran into problem with giant packets b

Re: pf + scrub fragment reassemble + if_bridge = bad?

2007-04-07 Thread Andrew Thompson
On Sat, Apr 07, 2007 at 03:01:09PM -0500, David Duchscher wrote: > Ran into a problem the other day and wanted to drop a note and see > if I should followup with a PR. Running a box as a bridging firewall > and ran into problem with giant packets being reported by the router > on one end and OSPF

pf + scrub fragment reassemble + if_bridge = bad?

2007-04-07 Thread David Duchscher
Ran into a problem the other day and wanted to drop a note and see if I should followup with a PR. Running a box as a bridging firewall and ran into problem with giant packets being reported by the router on one end and OSPF routing dropping. Seems that once a packet is reassembled by pf, it get

Re: A radical restructuring of IPsec...

2007-04-07 Thread Sam Leffler
Jeremie Le Hen wrote: > Hi, Bruce, > > On Sat, Apr 07, 2007 at 05:27:30AM +0100, Bruce M. Simpson wrote: >> I'm all for this in principle. I believe that the case for FAST_IPSEC >> over KAME IPSEC is fairly clear for those of us who have read the USENIX >> paper. Qualitatively speaking I can say

Re: Spillover routing?

2007-04-07 Thread Rajkumar S
On 4/7/07, Bruce M. Simpson <[EMAIL PROTECTED]> wrote: Rajkumar S wrote: > I have a low cost 128kbps and a high cost 512 kbps link to internet. > Is it possible to do a "spillover" routing This feature is almost certainly not going to be present in the base system. I was almost sure of this

Re: Spillover routing?

2007-04-07 Thread Bruce M. Simpson
Rajkumar S wrote: Hi, I have a low cost 128kbps and a high cost 512 kbps link to internet. Is it possible to do a "spillover" routing so that the high cost link is used only when the low cost link is, say, used more than 80%. This feature is almost certainly not going to be present in the base

Re: A radical restructuring of IPsec...

2007-04-07 Thread Jeremie Le Hen
Hi, Bruce, On Sat, Apr 07, 2007 at 05:27:30AM +0100, Bruce M. Simpson wrote: > I'm all for this in principle. I believe that the case for FAST_IPSEC > over KAME IPSEC is fairly clear for those of us who have read the USENIX > paper. Qualitatively speaking I can say FAST_IPSEC has been more > pl