From owner-freebsd-stable Fri Nov 22 9:11:33 2002 Delivered-To: freebsd-stable@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 0A59537B401 for ; Fri, 22 Nov 2002 09:11:32 -0800 (PST) Received: from sep.oldach.net (sep.oldach.net [194.180.25.6]) by mx1.FreeBSD.org (Postfix) with ESMTP id B612B43E6E for ; Fri, 22 Nov 2002 09:11:30 -0800 (PST) (envelope-from hmo@sep.oldach.net) Received: from sep.oldach.net (localhost [127.0.0.1]) by sep.oldach.net (8.12.6/8.12.6/hmo29jun02) with ESMTP id gAMHAagm093804 (version=TLSv1/SSLv3 cipher=EDH-DSS-DES-CBC3-SHA bits=168 verify=NO); Fri, 22 Nov 2002 18:10:36 +0100 (CET) (envelope-from hmo@sep.oldach.net) Received: (from hmo@localhost) by sep.oldach.net (8.12.6/8.12.6/Submit) id gAMHAToS093802; Fri, 22 Nov 2002 18:10:29 +0100 (CET) (envelope-from hmo) Message-Id: <200211221710.gAMHAToS093802@sep.oldach.net> Subject: Re: IPsec/gif VPN tunnel packets on wrong NIC in ipfw? SOLUTION A ND QUESTIONS In-Reply-To: <3DDE600D.1080509@isi.edu> from Lars Eggert at "Nov 22, 2002 11:49:17 am" To: larse@ISI.EDU (Lars Eggert) Date: Fri, 22 Nov 2002 18:10:29 +0100 (CET) Cc: freebsd-stable-21nov02@oldach.net, mcambria@avaya.com, archie@dellroad.org, guido@gvr.org, dkelly@hiwaay.net, hausen@punkt.de, sullrich@CRE8.COM, greg.panula@dolaninformation.com, FreeBSD-stable@FreeBSD.ORG From: Helge Oldach MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-freebsd-stable@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.ORG Lars Eggert: > > In practice the problem presented in the paper is commonly solved > > in a different fashion: By using GRE or IPIP encapsulation *plus* > > tunnel mode. > Why tunnel mode, specifically? Policy reasons, mentioned in my example: Enterprise networks tend to deploy RFC 1918 addresses also for transit links, in which case one cannot use transport mode. Helge To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message