From owner-freebsd-net@FreeBSD.ORG Sun Sep 21 18:45:00 2014 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 1E6BCF1E for ; Sun, 21 Sep 2014 18:45:00 +0000 (UTC) Received: from mail-qg0-f49.google.com (mail-qg0-f49.google.com [209.85.192.49]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (Client CN "smtp.gmail.com", Issuer "Google Internet Authority G2" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id CD0C7A0E for ; Sun, 21 Sep 2014 18:44:58 +0000 (UTC) Received: by mail-qg0-f49.google.com with SMTP id q107so1982868qgd.36 for ; Sun, 21 Sep 2014 11:44:52 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:content-type:mime-version:subject:from :in-reply-to:date:cc:content-transfer-encoding:message-id:references :to; bh=s9ODZQYerZ5qAuMB1voMEvyw+SLlrmvOxG9qhM1nUJ4=; b=a0dttom66aE+rM/FthvmoWz7NEYQueWpnaa3WReAq4llKdpjePOcwXZpJOuL4gQUnr yVOk64fsg54L/wJGeqpT3+9Zpdkesj+S+xAb7Bnivz6xAJSfwfDykr0rmjmiwwbKCzgM Aikn4phqqm3Z8KF01O+4E5b5bEDRsLVfbVk2tuHCNFZ/C9UB8emXHS5XI74+2nGTQreI rz3dBNmVRYkNapuYr0fP88ivRpkI7zBUf3skaQ4QVm7u/TI6f1bgfpW3lwobwwhjReXZ l2eMcQyn7yebTmX74x8SJKS8dTeLehQGAUD8IG2HbaqTbxfIxQRKcekh3meL8AU4RnYi Stag== X-Gm-Message-State: ALoCoQnZT80ByoI515MHTnbPYp+Yrs1blcpi/Ojct9uVmxiPTOQRL+OUKsYuDUOMIGJF6extZXhF X-Received: by 10.140.23.177 with SMTP id 46mr16988282qgp.64.1411325091847; Sun, 21 Sep 2014 11:44:51 -0700 (PDT) Received: from [29.134.39.245] (66-87-121-245.pools.spcsdns.net. [66.87.121.245]) by mx.google.com with ESMTPSA id s102sm6059343qgd.44.2014.09.21.11.44.50 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Sun, 21 Sep 2014 11:44:50 -0700 (PDT) Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (1.0) Subject: Re: IP fast forwarding and setkey From: Jim Thompson X-Mailer: iPhone Mail (12A365) In-Reply-To: Date: Sun, 21 Sep 2014 13:44:49 -0500 Content-Transfer-Encoding: quoted-printable Message-Id: <2F5CE512-4C4F-4D6B-A6DA-C349CF75C54D@netgate.com> References: <541EA396.7050201@winterei.se> To: =?utf-8?Q?Olivier_Cochard-Labb=C3=A9?= Cc: "freebsd-net@freebsd.org" , "Paul S." X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 21 Sep 2014 18:45:00 -0000 > On Sep 21, 2014, at 10:41, Olivier Cochard-Labb=C3=A9 = wrote: >=20 >> On Sun, Sep 21, 2014 at 12:08 PM, Paul S. wrote: >>=20 >> Hi folks, >>=20 >> I plan to make an edge router out of a freebsd system with OpenBGPD + >> FreeBSD 10, or such. >>=20 >> I've been reading up, and noticed that the net.inet.ip.fastforwarding fla= g >> provides rather nice performance benefits. >>=20 >> My issue is, my upstream networks insist on using TCP MD5 authentication >> on their BGP sessions. >>=20 >> This is fine, except on FreeBSD -- I'm going to have to use the setkey >> utility to set those since native PF_KEY support for OpenBGPD does not se= em >> available. >>=20 >> Now, since setkey is part of IPSec, and there are countless warnings abou= t >> using IPSec and fastforwarding together in the manpage, am I correct in >> assuming that this will not work if I have fastforwarding enabled? >>=20 >> Is there any way to make it work? Quagga, from what I've read, seems to >> also be in the same boat (Usage of setkey required for TCP MD5). > fastforwarding is not compatible with IPSec only but can be used with > TCP_MD5 without problem (tested on FreeBSD 10-stable). Even this is solvable, and will likely occur in a future version of pfSense.= =20 Jim