From owner-freebsd-security@FreeBSD.ORG Wed Oct 22 05:34:46 2003 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B416716A4B3 for ; Wed, 22 Oct 2003 05:34:46 -0700 (PDT) Received: from otter3.centtech.com (moat3.centtech.com [207.200.51.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0517643F85 for ; Wed, 22 Oct 2003 05:34:46 -0700 (PDT) (envelope-from anderson@centtech.com) Received: from centtech.com (neutrino.centtech.com [204.177.173.28]) by otter3.centtech.com (8.12.3/8.12.3) with ESMTP id h9MCYj6T046682; Wed, 22 Oct 2003 07:34:45 -0500 (CDT) (envelope-from anderson@centtech.com) Message-ID: <3F967956.5060307@centtech.com> From: Eric Anderson User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Jim Hatfield References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit cc: freebsd-security@freebsd.org Subject: Re: IPSec VPNs: to gif or not to gif X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Date: Wed, 22 Oct 2003 12:34:46 -0000 X-Original-Date: Wed, 22 Oct 2003 07:34:30 -0500 X-List-Received-Date: Wed, 22 Oct 2003 12:34:46 -0000 Jim Hatfield wrote: >I will shortly be replacing a couple of proprietary VPN boxes >with a FreeBSD solution. Section 10.10 of the Handbook has a >detailed description of how to do this. > >However I remember a lot of discussion about a year ago about >whether the gif interface was necessary to set up VPNs like >this or whether it was just a convenience, for "getting the >routing right". A number of people said that gif was not >needed but I've never found a step-by-step description of how >to set up a lan-to-lan VPN without using it. > I use gif interfaces for my VPN's, and it works extremely well. The only other solution I think I would even try, is mpd, but that uses a much weaker protocol from what I know (PPTP). It's so easy to use gif, I'm not sure why you wouldn't. Eric -- ------------------------------------------------------------------ Eric Anderson Systems Administrator Centaur Technology All generalizations are false, including this one. ------------------------------------------------------------------