From owner-freebsd-security  Fri Aug  2  6: 4:17 2002
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id AABE437B400; Fri,  2 Aug 2002 06:04:14 -0700 (PDT)
Received: from musique.teaser.net (musique.teaser.net [213.91.2.11])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id B0DB943E3B; Fri,  2 Aug 2002 06:04:13 -0700 (PDT)
	(envelope-from e-masson@kisoft-services.com)
Received: from notbsdems.nantes.kisoft-services.com (chantilly.kisoft-services.com [193.56.60.242])
	by musique.teaser.net (Postfix) with ESMTP
	id 4DDFD7250B; Fri,  2 Aug 2002 15:04:12 +0200 (CEST)
Received: by notbsdems.nantes.kisoft-services.com (Postfix, from userid 1001)
	id BBD155ADB9; Fri,  2 Aug 2002 14:56:39 +0200 (CEST)
To: "Crist J. Clark" <cjc@FreeBSD.ORG>
Cc: Matthew Grooms <mgrooms@seton.org>, dlavigne6@cogeco.ca,
	Mailing List FreeBSD Security <freebsd-security@FreeBSD.org>
Subject: Re: esp tunnel without gif(4) [Was Re: vpn1/fw1 NG to ipsec/racoon
 troubles, help please ...]
References: <sd455602.090@aus-gwia.aus.dcnhs.org>
	<20020730074813.GF89241@blossom.cjclark.org>
	<86znw5r9h3.fsf_-_@notbsdems.nantes.kisoft-services.com>
From: Eric Masson <e-masson@kisoft-services.com>
In-Reply-To: <86znw5r9h3.fsf_-_@notbsdems.nantes.kisoft-services.com> (Eric
 Masson's message of "Fri, 02 Aug 2002 09:44:08 +0200")
X-Operating-System: FreeBSD 4.6-STABLE i386
Date: Fri, 02 Aug 2002 14:56:39 +0200
Message-ID: <86k7n9qv08.fsf@notbsdems.nantes.kisoft-services.com>
Lines: 38
User-Agent: Gnus/5.090007 (Oort Gnus v0.07) XEmacs/21.4 (Common Lisp,
 i386--freebsd)
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

>>>>> "Emss" == Eric Masson <e-masson@kisoft-services.com> writes:
>>>>> "Crist" == Crist J Clark <crist.clark@attbi.com> writes:

Follow-up to myself and -security re-added.

 Crist> I've never figured out why people use gif(4) interfaces when ESP
 Crist> does the tunneling for you.

 Emss> Maybe because I've never succeeded establishing a esp tunnel
 Emss> beetween two lans without gif(4).

I've tried without gif tunnel (erroneous rc.conf modification) and it
works, maybe murphy's law had prevented this before ;)

There's one question still remaining :
- if there are more than one esp tunnel configured, how is traffic
  routed ?

Example :
- One esp tunnel from 192.168.0.1 to 10.93.0.1
- One esp tunnel from 192.168.0.1 to 10.44.0.1

With only one tunnel configured, netstat -rn on the security gateway
doesn't show any routes to the remote networks nor host.

With a second tunnel added, are there any additionnal configuration
steps or will the kernel do the routing automagically ?

Links or example setup if needed ?

Thanks in advance

Eric Masson

-- 
 Bref, j'en ai lu des conneries dans fufe, j'en ai même écrit, mais là,
 on flirte avec le ruban bleu.
 -+- RM in : <http://www.le-gnu.net> - Ca mérite le GNUban bleu -+-

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message