From owner-freebsd-net  Thu Mar 21 22:15: 8 2002
Delivered-To: freebsd-net@freebsd.org
Received: from InterJet.dellroad.org (adsl-63-194-81-26.dsl.snfc21.pacbell.net [63.194.81.26])
	by hub.freebsd.org (Postfix) with ESMTP id EA6ED37B400
	for <net@FreeBSD.ORG>; Thu, 21 Mar 2002 22:15:02 -0800 (PST)
Received: from arch20m.dellroad.org (arch20m.dellroad.org [10.1.1.20])
	by InterJet.dellroad.org (8.9.1a/8.9.1) with ESMTP id WAA13065;
	Thu, 21 Mar 2002 22:12:57 -0800 (PST)
Received: (from archie@localhost)
	by arch20m.dellroad.org (8.11.6/8.11.6) id g2M6Cn916951;
	Thu, 21 Mar 2002 22:12:49 -0800 (PST)
	(envelope-from archie)
From: Archie Cobbs <archie@dellroad.org>
Message-Id: <200203220612.g2M6Cn916951@arch20m.dellroad.org>
Subject: Re: IPSec for roaming user?
In-Reply-To: <20020320140353.19403.qmail@web20006.mail.yahoo.com>
 "from Vincent Chen at Mar 20, 2002 06:03:53 am"
To: Vincent Chen <vctw@yahoo.com>
Date: Thu, 21 Mar 2002 22:12:49 -0800 (PST)
Cc: net@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL88 (25)]
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset=US-ASCII
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org

Vincent Chen writes:
> I am trying to figure out how to let roaming users
> access internal resource via freebsd as IPsec gateway.
> Because they have dynamic IPs. How can I write
> security policy to deal with this? Is there any IPsec
> client for windows platform available?

It depends on the client. racoon supports accepting connections
from arbitrary IP addresses.

On Win2k you can use the built-in client if you go through the
complex configuration required. Even so, you have to reconfigure
everytime your IP address changes.

Better yet, buy a commercial IPSec client such as Netscreen.

> it ok to let ESP packet coming in and out from anywhere?

Yes.

-Archie

__________________________________________________________________________
Archie Cobbs     *     Packet Design     *     http://www.packetdesign.com

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message