From owner-freebsd-security@FreeBSD.ORG  Wed Oct 22 04:28:47 2003
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id E73BD16A4B3
	for <freebsd-security@freebsd.org>;
	Wed, 22 Oct 2003 04:28:47 -0700 (PDT)
Received: from highland.isltd.insignia.com (highland.isltd.insignia.com
	[195.74.141.1])	by mx1.FreeBSD.org (Postfix) with ESMTP id CB2B443F85
	for <freebsd-security@freebsd.org>;
	Wed, 22 Oct 2003 04:28:46 -0700 (PDT)
	(envelope-from subscriber@insignia.com)
Received: from dailuaine.isltd.insignia.com (dailuaine.isltd.insignia.com
	[172.16.64.11])h9MBSjf2048547	for <freebsd-security@freebsd.org>;
	Wed, 22 Oct 2003 12:28:45 +0100 (BST)
	(envelope-from subscriber@insignia.com)
Received: from tomatin (tomatin [172.16.64.128])h9MBSjSX084154
	for <freebsd-security@freebsd.org>;
	Wed, 22 Oct 2003 12:28:45 +0100 (BST)
	(envelope-from subscriber@insignia.com)
From: Jim Hatfield <subscriber@insignia.com>
To: freebsd-security@freebsd.org
Date: Wed, 22 Oct 2003 12:28:45 +0100
Organization: Insignia Solutions
Message-ID: <u0qcpv0csl3lb1p6a8aioe7qjqjtvd6th9@4ax.com>
X-Mailer: Forte Agent 1.91/32.564
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: quoted-printable
X-Scanned-By: MIMEDefang 2.38
Subject: IPSec VPNs: to gif or not to gif
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 22 Oct 2003 11:28:48 -0000

I will shortly be replacing a couple of proprietary VPN boxes
with a FreeBSD solution. Section 10.10 of the Handbook has a=20
detailed description of how to do this.

However I remember a lot of discussion about a year ago about
whether the gif interface was necessary to set up VPNs like
this or whether it was just a convenience, for "getting the
routing right". A number of people said that gif was not=20
needed but I've never found a step-by-step description of how
to set up a lan-to-lan VPN without using it.

Is the Handbook the current received wisdom on how to set this
up, and is the use of the gif interface indeed necessary?

I also remember that the discussions diverted into a problem
with ipfw when gif was *not* used, but I haven't found any
messages to indicate that it was resolved. I recall suggestions
that a new interface esp0 be created so that ipfw could work
correctly on both the innner and outer packets of an ESP tunnel.

Was that issue ever resolved?

jim hatfield