Date: Sun, 1 Jan 2006 20:42:53 +0000 (GMT) From: Nate Nielsen <nielsen-list@memberwebs.com> To: Brian Candler <B.Candler@pobox.com> Cc: freebsd-net@freebsd.org Subject: Re: IPSEC documentation Message-ID: <20060101204253.3976870DDA9@mail.npubs.com> References: <20051228143817.GA6898@uk.tiscali.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Brian Candler wrote: > The IPSEC documentation at > http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html is > pretty weird. It suggests that you encapsulate your packets in IP-IP (gif) > encapsulation and THEN encapsulate that again using IPSEC tunnel mode. <snip> > This is a really strange approach which is almost guaranteed not to > interoperate with other IPSEC gateways. (It might be useful if you were > using etherip encapsulation and attempting to bridge two remote networks, > but that's not what it's doing either. In any case, if you're encapsulating > with a different protocol then you only need IPSEC transport mode, not > tunnel mode) That's what I've found the easiest: Encapsulation with gif tunnels and then IPSec transport mode encryption. Due to the way IPSec Tunnel mode is implemented routing protocols don't work well over it (ie: most routing protocols need an interface and next hop). > ISTM that this chapter should be rewritten to use IPSEC tunnel mode solely. > Do people here generally agree? If so I'll try to find the time to modify > it. I'd suggest adding, not replacing. Cheers, Nate
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060101204253.3976870DDA9>