From owner-freebsd-net@FreeBSD.ORG Tue Jun 22 18:22:46 2010 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id C713C106564A for ; Tue, 22 Jun 2010 18:22:46 +0000 (UTC) (envelope-from ddesimone@verio.net) Received: from relay1-bcrtfl2.verio.net (relay1-bcrtfl2.verio.net [131.103.218.142]) by mx1.freebsd.org (Postfix) with ESMTP id 7ADDF8FC16 for ; Tue, 22 Jun 2010 18:22:46 +0000 (UTC) Received: from iad-wprd-xchw02.corp.verio.net (unknown [198.87.7.165]) by relay1-bcrtfl2.verio.net (Postfix) with ESMTP id BEE59B0380D1 for ; Tue, 22 Jun 2010 14:22:45 -0400 (EDT) Thread-Index: AcsSN+konsqVKXCMQLOwmYmfm2oTDg== Received: from dllstx1-8sst9f1.corp.verio.net ([10.144.2.52]) by iad-wprd-xchw02.corp.verio.net over TLS secured channel with Microsoft SMTPSVC(6.0.3790.4675); Tue, 22 Jun 2010 14:22:44 -0400 Received: by dllstx1-8sst9f1.corp.verio.net (sSMTP sendmail emulation); Tue, 22 Jun 2010 13:22:43 -0500 Date: Tue, 22 Jun 2010 13:22:43 -0500 From: "David DeSimone" Content-Transfer-Encoding: 7bit To: Message-ID: <20100622182242.GU2620@verio.net> Mail-Followup-To: freebsd-net@freebsd.org Content-class: urn:content-classes:message Importance: normal Priority: normal X-MimeOLE: Produced By Microsoft MimeOLE V6.00.3790.4657 References: <87260c422232fa7409a4b374341dd106@ewipo.pl> <20100622143543.GA72020@zeninc.net> <20100622153541.GA72211@zeninc.net> <6caa9895ae1710b9f48a227116a4340c@ewipo.pl> <20100622190819.270aaa74@gda-arsenic> <4f378cfb416582c3081377ba714e508a@ewipo.pl> <20100622201130.5824d585@gda-arsenic> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Disposition: inline In-Reply-To: <20100622201130.5824d585@gda-arsenic> Precedence: bulk User-Agent: Mutt/1.5.20 (2009-06-14) X-OriginalArrivalTime: 22 Jun 2010 18:22:44.0381 (UTC) FILETIME=[E88654D0:01CB1237] Subject: Re: vpn trouble X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 22 Jun 2010 18:22:46 -0000 Maciej Suszko wrote: > > > So as you write they should set: ?? > > 10.20.0.1 (my ip on gif device) <-> 78.x <-> 95.x <-> 10.10.1.90 > > (other side) > > Yes, indeed. > > > And additionaly I thing I should correct set spd policy to: > > > > spdadd 10.20.0.1 10.10.1.90 any -P out ipsec > > esp/tunnel/78.x.x.x-95.x.x.x/require; > > spdadd 10.10.1.90 10.20.0.1 any -P in ipsec > > esp/tunnel/95.x.x.x-78.x.x.x/require; > > > > Am I wrong? > > No, you're right :) > > You can set up the tunnel first - check whether both 10. are accessible > from both sides, then you "cover" communication between them with IPSEC. Will this sort of GIF tunnel interoperate with Cisco and/or Checkpoint VPN equipment? In our tests we were able to use pure IPSEC tunnel encapsulation to interoperate with these sorts of devices, so we never found a need for GIF encapsulation. -- David DeSimone == Network Admin == fox@verio.net "I don't like spinach, and I'm glad I don't, because if I liked it I'd eat it, and I just hate it." -- Clarence Darrow This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. Verio, Inc. makes no warranty that this email is error or virus free. Thank you.