Date: Fri, 06 Sep 2002 01:04:51 -0400 From: Mike Tancsa <mike@sentex.net> To: Tillman Hodgson <tillman@seekingfire.com> Cc: questions@FreeBSD.ORG Subject: Re: IPSEC & routing w/o gif Message-ID: <5.1.0.14.0.20020906010034.03d89220@192.168.0.12> In-Reply-To: <20020905225049.A13151@seekingfire.com> References: <vq9gnu0qk29fjk0un4tne8vku57f33vmh2@4ax.com> <mailman.1031178127.4718.fquestions-l@lists.sentex.ca> <vq9gnu0qk29fjk0un4tne8vku57f33vmh2@4ax.com>
next in thread | previous in thread | raw e-mail | index | archive | help
At 10:50 PM 9/5/2002 -0600, Tillman Hodgson wrote:
> > ping -S 192.168.32.2 192.168.31.206
> >
> > Otherwise, the IP stack will automatically chose the source address based
> > upon the next hop.
>
>That explains my discovery that the tunnel *does* work, from
>workstations behind the gateway. Thanks!
>
>How does this interact with and affect dynamic routing (i.e., OSPF via
>zebra)?
In a word, badly :-( You need to look at something like l2tp or ppp over
the link... Or, use gif and transport mode.
>We've now got a mostly-working config, and an NFS mount works across it
>:-) The remaining problem is that after a period of time the FreeBSD box
>can't access the other side ("sendto: No route to host").
Have a look at the racoon.conf options, there might be a setting there I
think. But you might want to post the question and your config to the KAME
list. But I do remember reading about this on the LINUX FreeSwan page, so
it might be some LINUX issue. When the tunnel goes stale like that, what
does setkey -D show ?
---Mike
--------------------------------------------------------------------
Mike Tancsa, tel +1 519 651 3400
Sentex Communications, mike@sentex.net
Providing Internet since 1994 www.sentex.net
Cambridge, Ontario Canada www.sentex.net/mike
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5.1.0.14.0.20020906010034.03d89220>