Re: IPSEC Interop problem with Cisco using multiple SA's

2006-05-09 Thread VANHULLEBUS Yvan
On Mon, May 08, 2006 at 10:04:29PM -0500, David DeSimone wrote: > Eugene M. Kim <[EMAIL PROTECTED]> wrote: > > > > I haven't tried this myself, but you may want to try using > > "unique:" instead of "require" as the policy level > > After reading up on this behavior, I gave it a try, replacing all

Re: IPSEC Interop problem with Cisco using multiple SA's

2006-05-08 Thread David DeSimone
Eugene M. Kim <[EMAIL PROTECTED]> wrote: > > I haven't tried this myself, but you may want to try using > "unique:" instead of "require" as the policy level After reading up on this behavior, I gave it a try, replacing all "require" policies with "unique". I found that there was no need to set a

Re: IPSEC Interop problem with Cisco using multiple SA's

2006-05-08 Thread Eugene M. Kim
I haven't tried this myself, but you may want to try using "unique:" instead of "require" as the policy level, with set to a unique policy identifier, which is an integer you can pick between 1 and 32767 inclusive, for each security policy. This makes the security policy "claim" the security a

IPSEC Interop problem with Cisco using multiple SA's

2006-05-08 Thread David DeSimone
I am having a problem establishing peering between my FreeBSD 6.0 gateway and a Cisco device, using IPSEC. The peering works fine if there is only one subnet behind the remote gateway, but it fails when there is more than one subnet. I believe the FreeBSD side is failing to be as strict with the