Date: Tue, 1 Oct 2002 13:51:03 -0400 From: "Cambria, Mike" <mcambria@avaya.com> To: "'freebsd-net@freebsd.org'" <freebsd-net@freebsd.org> Subject: IPsec & Multiple WAN links Message-ID: <3A6D367EA1EFD4118C9B00A0C9DD99D7E4EE06@rerun.avayactc.com>
next in thread | raw e-mail | index | archive | help
Hi, I've been running FreeBSD on 2 boxes, each with their own WAN links for over 18 months or so. Each box has its own WAN link (one uses T1 leased line to a remote site, the other uses DSL to an ISP.) The ISP link runs IPsec and racoon The other end of the IPsec tunnel is a VPN appliance. The ISP (and IPsec tunnels) is used to backup the T1. I now want to move both WAN links to one FreeBSD box (in time on Soekris HW.) I am having trouble duplicating the desired IPsec policies when both WAN links are in one box, and only one needs (should) have IPsec enabled on it. How can I define a SPD for just the interface that I need? Using setkey, spdadd doesn't let me specify which interface IPsec is to be defined for. Before: With the working config, (i.e. two boxes), since there is only one WAN link per box, the SPD (and IPsec) only exist on the box connected to the Internet. When a packet destine to a subnet routes via the T1 "leased line" box, (the normal case) things work. When this T1 is up, routing makes this the shortest path. When a packet destined to this same subnet follows the default route to the IPsec box, (e.g. T1 link is down) the SPD on the FreeBSD box applies the defined IPsec policy (e.g. tunnel & 3DES) and sends the packet to the VPN appliance at the other end of the tunnel. After: When both WAN links are in one box, the packet is always encrypted and send to the tunnel endpoint, but via the T1 link. Since the tunnel endpoint is the public side of the VPN appliance, the packet is dropped as it reaches that device via the private Ethernet port. (This is today, after I had the firewall at the remote end of the T1 stop dropping IPsec packets.) I'm running 4.6-Stable (cvsup'ed both source & ports after 4.6.2). Thanks, MikeC To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?3A6D367EA1EFD4118C9B00A0C9DD99D7E4EE06>