From owner-freebsd-questions@FreeBSD.ORG Thu Nov 1 10:53:29 2007 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 2E1F116A419 for ; Thu, 1 Nov 2007 10:53:29 +0000 (UTC) (envelope-from sudakov@sibptus.tomsk.ru) Received: from relay2.tomsk.ru (relay2.tomsk.ru [212.73.124.8]) by mx1.freebsd.org (Postfix) with ESMTP id 6A78613C4A6 for ; Thu, 1 Nov 2007 10:53:27 +0000 (UTC) (envelope-from sudakov@sibptus.tomsk.ru) X-Virus-Scanned: by Dr.Web (R) daemon for FreeBSD, v4.33 at relay2.tomsk.ru Received: from admin.sibptus.tomsk.ru (account sudakovva@sibptus.tomsk.ru [212.73.125.240] verified) by relay2.tomsk.ru (CommuniGate Pro SMTP 4.3.8) with ESMTPSA id 9314271 for freebsd-questions@freebsd.org; Thu, 01 Nov 2007 15:45:12 +0600 Received: (from sudakov@localhost) by admin.sibptus.tomsk.ru (8.13.6/8.13.6/Submit) id lA19jBVT070823 for freebsd-questions@freebsd.org; Thu, 1 Nov 2007 15:45:11 +0600 (OMST) (envelope-from sudakov@sibptus.tomsk.ru) X-Authentication-Warning: admin.sibptus.tomsk.ru: sudakov set sender to sudakov@sibptus.tomsk.ru using -f Date: Thu, 1 Nov 2007 15:45:11 +0600 From: Victor Sudakov To: User Questions Message-ID: <20071101094511.GA70701@admin.sibptus.tomsk.ru> Mail-Followup-To: Victor Sudakov , User Questions References: <20071026095508.GA60816@admin.sibptus.tomsk.ru> <1193413500.2919.30.camel@ingress.pitbpa0.priv.collaborativefusion.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1193413500.2919.30.camel@ingress.pitbpa0.priv.collaborativefusion.com> User-Agent: Mutt/1.4.2.1i Organization: AO "Svyaztransneft", SibPTUS X-PGP-Key: http://vas.tomsk.ru/vas.asc Subject: Re: IPSec SPD X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Nov 2007 10:53:29 -0000 Brian A Seklecki (Mobile) wrote: > > > > Suppose our remote office uses the 10.1.1.0/24 network, and the whole > > company uses the 10.0.0.0/8 network. > > > > How do we set up the SPD entries to encrypt traffic to the > > headquarters and back? > > > > I do hub a spoke config just like this using OpenBSD and Cisco VPN3k > using /24s at the edge and /16s at the core. All works well. Better > than full mesh. > > I just ran into a small bug with the new Ipsec stack in OpenBSD where I > had to have a "null" policy -- otherwise traffic with destination routes > for the locally connected /24 would accidentally be fwd'd across the > tunnel (because ipsec tunnel evaluation happens earlier in ip_output(), > which is non-standard) > > > > spdadd 10.0.0.0/8 10.1.1.0/24 > > ... > > spdadd 10.1.1.0/24 10.0.0.0/8 > > ... Thank you Brian, this works. I should not have worried. On FreeBSD 6.2 it works even without any "null" policy (I think you meant the "none" policy). -- Victor Sudakov, VAS4-RIPE, VAS47-RIPN sip:sudakov@sibptus.tomsk.ru