Date: Tue, 09 Apr 2002 09:18:50 -0700 From: Lars Eggert <larse@ISI.EDU> To: Dennis Pedersen <trm@daydreamer.dk> Cc: freebsd-net@freebsd.org Subject: Re: IPsec tunnel mode Message-ID: <3CB3146A.7080906@isi.edu> References: <MPENKFCCIIDAJKJJOLBHMEAJCNAA.tariq@inty.net> <5.1.0.14.0.20020408200151.01cac1f0@mail.drwilco.net> <007501c1df3f$326d92a0$0301a8c0@dpws> <3CB20A6D.3040704@isi.edu> <00a801c1dfaf$925aa750$0301a8c0@dpws>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Dennis Pedersen wrote: > But uhm is there a 'simple' way of doing this? (as in just adding the IP of > the other ends gif interface as destinatio in my routes? > The setup today i an exact copy of (other IP's of course) > www.freebsddiary.org/ipsec-tunnel.php > This works just fine besides til problem with my routes, arcording to the > draft IPIP is the solution. My Question is now how do i set up with an IPIP > tunnel? > On http://rr.sans.org/firewall/IPSec_VPN.php there is an example, from my > point of view it looks kind of complicated. Can it be made any simpler? > If this is the way to do it, can i run mutible natd on both my external > interface and the virtual gif interface (the howto creates the gif tunnel > and diverts all trafic into this tunnel with natd on both ends) and how? > (because i can't really se how the ipfw add divert natd can tell the > difference between te 2 sessions of natd) Both setup instructions you gave URLs for are broken in the respect that they tell you to set up IPIP tunnels and IPsec tunnel mode SAs in parallel. IPsec tunnel mode under KAME does not use gif interfaces. This works in some situations, because the interaction of side effects is just right. These instructions in fact set up a secure and a non-secure path between the two security gateways, and work by intercepting packets sent over the non-secure path and pushing them into the secure tunnel. This can have all sorts of interesting failure modes. Setting up the other approach (IPIP tunnel + IPsec transport mode) works by first setting up the tunnels (see the gifconfig/ifconfig man pages) and stringing the topology together with route (route man page). No other commands are needed. Once this works (i.e. you see correctly encapsulated packets flow between your machines) you can then manually configure IPsec transport mode SAs (via setkey) or use IKE. Lars -- Lars Eggert <larse@isi.edu> Information Sciences Institute http://www.isi.edu/larse/ University of Southern California [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T0)0 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 000830000000Z 020829235959Z01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.3000 *H 0 32c %E>nx'gڈD)c5*mp<ܮto034qmOe KaU5u'rװ |CBPQ<9TIf - ki N0L0)U "0 0 10UPrivateLabel1-2970U 0 0 U 0 *H so&e4KYbDI j&*b ct mSK8P:l4撜n# KrgPo.X PW Ո9[9}4%MjÑ/<RbH10001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 + a0 *H 1 *H 0 *H 1 020409161850Z0# *H 1ؐ4ӛʛN8Jg0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H 101 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 *H A`ZBE9{HӤ3 %g5: Mˁ q1Vo_I\$/|pKPN3Pq;$`k<@()|,&M=^We"%Rk! \a
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3CB3146A.7080906>