From owner-freebsd-net  Sat Apr 20 22:12: 6 2002
Delivered-To: freebsd-net@freebsd.org
Received: from web20004.mail.yahoo.com (web20004.mail.yahoo.com [216.136.225.49])
	by hub.freebsd.org (Postfix) with SMTP id 3E37637B41A
	for <freebsd-net@freebsd.org>; Sat, 20 Apr 2002 22:12:05 -0700 (PDT)
Message-ID: <20020421051205.33101.qmail@web20004.mail.yahoo.com>
Received: from [61.223.0.54] by web20004.mail.yahoo.com via HTTP; Sat, 20 Apr 2002 22:12:05 PDT
Date: Sat, 20 Apr 2002 22:12:05 -0700 (PDT)
From: Vincent Chen <vctw@yahoo.com>
Subject: why prefer old SA in KAME's IPSec?
To: freebsd-net@freebsd.org
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-net@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-net.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-net>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-net>
X-Loop: FreeBSD.org


Dear all,

I tried to establish ipsec tunnel between freebsd and
several other platforms. Recently, I found that ipsec
usually failed after the other machine reboot or
crash. It seems that the machine use new SA after
re-negotiate
but freebsd use old SA. After searching maillist, I
found that net.key.prefered_oldsa=0 will solve that
problem. But why prefer old one?


Thanks,

Vincent Chen


__________________________________________________
Do You Yahoo!?
Yahoo! Games - play chess, backgammon, pool and more
http://games.yahoo.com/

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message