Date: Sun, 21 Sep 2014 12:26:42 +0200 From: =?UTF-8?Q?Ermal_Lu=C3=A7i?= <eri@freebsd.org> To: "Paul S." <contact@winterei.se> Cc: freebsd-net <freebsd-net@freebsd.org> Subject: Re: IP fast forwarding and setkey Message-ID: <CAPBZQG0gCAzmOqr36VZGV1GSaO_8eXdfPV5GqSzO4g4ju%2B6u2A@mail.gmail.com> In-Reply-To: <541EA396.7050201@winterei.se> References: <541EA396.7050201@winterei.se>
next in thread | previous in thread | raw e-mail | index | archive | help
If for you is an option pfSense has all the hard work done for you and you can use it for such installations. On Sun, Sep 21, 2014 at 12:08 PM, Paul S. <contact@winterei.se> wrote: > Hi folks, > > I plan to make an edge router out of a freebsd system with OpenBGPD + > FreeBSD 10, or such. > > I've been reading up, and noticed that the net.inet.ip.fastforwarding flag > provides rather nice performance benefits. > > My issue is, my upstream networks insist on using TCP MD5 authentication > on their BGP sessions. > > This is fine, except on FreeBSD -- I'm going to have to use the setkey > utility to set those since native PF_KEY support for OpenBGPD does not seem > available. > > Now, since setkey is part of IPSec, and there are countless warnings about > using IPSec and fastforwarding together in the manpage, am I correct in > assuming that this will not work if I have fastforwarding enabled? > > Is there any way to make it work? Quagga, from what I've read, seems to > also be in the same boat (Usage of setkey required for TCP MD5). > > I tried searching the manpages, but couldn't locate anything concrete on > this. > > Any assistance/replies are welcome. > > Thank you! > _______________________________________________ > freebsd-net@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-net > To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org" > -- Ermal
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?CAPBZQG0gCAzmOqr36VZGV1GSaO_8eXdfPV5GqSzO4g4ju%2B6u2A>