Date: Mon, 08 Apr 2002 14:43:50 -0700 From: Lars Eggert <larse@ISI.EDU> To: Julian Elischer <julian@elischer.org> Cc: "Rogier R. Mulhuijzen" <drwilco@drwilco.net>, mgt@hytekblue.com, freebsd-net@FreeBSD.ORG Subject: Re: IPsec tunnel mode Message-ID: <3CB20F16.3000904@isi.edu> References: <Pine.BSF.4.21.0204081425380.52929-100000@InterJet.elischer.org>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] Julian Elischer wrote: > Assign the required address to the netgraph interface and then > use the IP-over-UDP example in the netgraph examples. Good idea. IP-over-UDP has advantages when it comes to firewall- and NAT-traversal. IP-over-IP has the advantage that it looks like IPsec tunnel mode on the wire and to the receiver, so it can interoperate. > On Mon, 8 Apr 2002, Lars Eggert wrote: > > >>Rogier R. Mulhuijzen wrote: >> >> http://www.x-itec.de/projects/tuts/ipsec-howto.txt >> > >> > Unfortunately this howto, like any other mention of IPsec & >> > tunneling on the net uses the gif interface. Which is IPoverIP, and >> > this does not seem to match with IPsec tunnel devices. >> >>There are no IPsec tunnel devices in KAME. IPsec defines "security >>associations" (SAs), which are not represented as devices in the routing >>table in KAME. Thus, you can't use routes to direct traffic into these >>tunnel mode SAs, you need to set up your security policies with the >>correct selectors (think firewall-like matching). >> >>*Many* tutorials on the net do not understand this disctinction, and >>tell you to set up an IPIP tunnel (using a gif) and an IPsec tunnel >>mode SA in parallel. This is a bad hack, since you (ab)use a side effect >>of creating an IPIP tunnel device (it can be used for route entries) to >>redirect traffic into your (separate) tunnel mode SA. Very roughly, you >>set up the IPIP tunnel, then yank out the packets destined for it during >>outbound processing and force them over an IPsec tunnel mode SA. >> >>Use EITHER IPsec tunnel mode alone OR IPIP tunnels and IP transport >>mode (draft-touch-ipsec-vpn). Mixing both can work in some scenarios >>where the dependencies between side effects are just right, but in >>general, it's a broken approach. >> >>Lars >>-- >>Lars Eggert <larse@isi.edu> Information Sciences Institute >>http://www.isi.edu/larse/ University of Southern California >> > -- Lars Eggert <larse@isi.edu> Information Sciences Institute http://www.isi.edu/larse/ University of Southern California [-- Attachment #2 --] 0 *H 01 0 + 0 *H 00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T00 G0 *H 01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.300 010824164000Z 020824164000Z0T10 UEggert1 0 U*Lars10U Lars Eggert1 0 *H larse@isi.edu00 *H 0 |\Pw v~~ FDooӦA\- Cˀ4.)&{肋 ,z (ܷر߈T7_'txGH^tt/ҹB8%t<#ֲN V0T0*+e!0 00L2uMyffBNUbNJJcdZ2s0U 0 larse@isi.edu0 U 0 0 *H aJPMՒ ]cѭC+kS+wZ1gY",YT41 j 6:~℩ D~Kؚl=u(ՎM?cF7@}T0)0 0 *H 01 0 UZA10U Western Cape10U Cape Town10U Thawte Consulting1(0&U Certification Services Division1$0"UThawte Personal Freemail CA1+0) *H personal-freemail@thawte.com0 000830000000Z 020829235959Z01 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.3000 *H 0 32c %E>nx'gڈD)c5*mp<ܮto034qmOe KaU5u'rװ |CBPQ<9TIf - ki N0L0)U "0 0 10UPrivateLabel1-2970U 0 0 U 0 *H so&e4KYbDI j&*b ct mSK8P:l4撜n# KrgPo.X PW Ո9[9}4%MjÑ/<RbH10001 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 + a0 *H 1 *H 0 *H 1 020408214350Z0# *H 1]ρ>S4#_d-0R *H 1E0C0 *H 0*H 0 *H @0+0 *H (0 *H 101 0 UZA10U Western Cape10U Cape Town10 U Thawte1 0U Certificate Services1(0&U Personal Freemail RSA 2000.8.30G0 *H K݆^oGO0sOܶ+"_HL=t0^to)q$dPMQaTEn@qďep=\eK:{d}}pV0Jc!/
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3CB20F16.3000904>