IPSEC documentation

The IPSEC documentation at
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ipsec.html is
pretty weird. It suggests that you encapsulate your packets in IP-IP (gif)
encapsulation and THEN encapsulate that again using IPSEC tunnel mode.

e.g. notice where it shows

spdadd W.X.Y.Z/32 A.B.C.D/32 ipencap -P out ipsec esp/tunnel/W.X.Y.Z-A.B.C.D/require;
spdadd A.B.C.D/32 W.X.Y.Z/32 ipencap -P in ipsec esp/tunnel/A.B.C.D-W.X.Y.Z/require;
...
ipfw add 1 allow esp from A.B.C.D to W.X.Y.Z
ipfw add 1 allow esp from W.X.Y.Z to A.B.C.D
ipfw add 1 allow ipencap from A.B.C.D to W.X.Y.Z
ipfw add 1 allow ipencap from W.X.Y.Z to A.B.C.D

('ipencap' is IP protocol 4, aka RFC 2003 encapsulation). The diagram
beneath makes this double-tunnelling explicit.

This is a really strange approach which is almost guaranteed not to
interoperate with other IPSEC gateways. (It might be useful if you were
using etherip encapsulation and attempting to bridge two remote networks,
but that's not what it's doing either. In any case, if you're encapsulating
with a different protocol then you only need IPSEC transport mode, not
tunnel mode)

ISTM that this chapter should be rewritten to use IPSEC tunnel mode solely.
Do people here generally agree? If so I'll try to find the time to modify
it.

Regards,

Brian.
_______________________________________________
freebsd-net@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: IPSEC documentation
    ... It suggests that you encapsulate your packets in IP-IP (gif) ... > encapsulation and THEN encapsulate that again using IPSEC tunnel mode. ...
    (freebsd-net)
  • IPSec - PPP inside L2TP inside UDP - why? when?
    ... I'm a bit confused about the various options for securing traffic with IPSec ... Is that encapsulation only performed ... If I simply want to secure client -> ... large-scale wireless LAN deployment. ...
    (microsoft.public.security)
  • Re: IPSec - PPP inside L2TP inside UDP - why? when?
    ... You're right: L2TP is point-to-point. ... encapsulation, ... To secure traffic on LAN, use IPsec in transport mode, which is done ... If I simply want to secure client -> ...
    (microsoft.public.security)
  • Re: Windows 2003 IPSEC example for SQL
    ... You can use AH or ESP with null encryption to accomplish this. ... Is this SQL server sitting in a DMZ or on a corporate LAN segment on the ... > Encapsulation is the next step. ... do I need to filter 1434/UDP in IPSEC for SQL? ...
    (microsoft.public.windows.server.security)
  • Re: Routing IPSEC packets?
    ... > I was looking around for using IPsec services instead of ... > implementation of IPsec, ... compatible with regular tunnel mode IPsec. ... IPsec devices that use IPsec tunnel mode. ...
    (freebsd-net)