IPSEC documentation

[VANHULLEBUS Yvan]

On Thu, Dec 29, 2005 at 09:50:47AM +0300, Alexey Popov wrote:
> Hi.
> 
> VANHULLEBUS Yvan wrote:
> >>- L2TP + IPSEC transport mode (= Windows road warrier)
> >Did someone tried such a setup ?
> >is there a L2TPD daemon running on FreeBSD which could be used for
> >that ?
> I'm successfully using security/racoon and net/sl2tps with Windows 
> XP/2003 L2TP clients. I've tried pre-shared key as well as X.509 
> certificates auth.

Interesting, I'll try to play with that !


> >Note also that, for now, this won't work easily, as it will require
> >dynamic SP entries (roadwarriors....), but I think racoon currently
> >can't deal with dynamic policies when ports specified (I'll check
> >that).
> racoon has passive_mode option. When it is enabled, racoon can create 
> SPD entries for road warriors.

Not exactly: generating policies works when racoon is responder (so
passive_mode is just a safety check).

And I was just talking about potential complex bundles (don't remember
exactly what windows sends for phase2, but I think first proposals are
AH+ESP, which will cause problem for generating policies with actual
racoon's versions) and about policies with ports only (but perhaps I
only had some problems with complex bundles when I had a quick look at
such negociations).


> If we would also have NAT-T support, FreeBSD would be the best choice 
> of VPN concentrator.

Ipsec-tools port is set to natt "kernel autodetect", and I already
have a working patch for FreeBSD6
(http://ipsec-tools.sf.net/freebsd6-natt.diff), which will need some
more work (cleaner way of detecting kernel NAT-T support, sync with
recent NetBSD devels, port to FAST-IPSEC, etc...), which are all on my
(very busy) TODO list.


Yvan.

-- 
NETASQ - Secure Internet Connectivity
http://www.netasq.com