IPsec tunnel mode with gif

[Kajetan Staszkiewicz]

Hi group,

For many years I have used the trick of running a GRE or GIF tunnel encrypted 
with IPSec transport mode, both on FreeBSD and Linux. That allows me to run 
BGP or OSPF on the tunnels.

I am also aware of IPsec tunnel mode which kind of works for me, although is 
not my personal choice.

Both modes of operation seem quite straightforward.

Yet for a reason beyond my understanding FreeBSD handbook proposes a 3rd mode: 
using a GIF tunnel together with IPSec tunnel mode. I really don't understand 
how is that supposed to work. People On The Internet also seem not to be able 
to understand the reasoning behind such solution. Since IPSec stack provides 
its own encapsulation in tunnel mode, packets coming to a router would never 
reach the GIF interface and would never be encapsulated by it. Same for 
packets received, they would be deencapsulated by IPsec stack and reinjected 
with internal IP addresses on a public interface of router or they would 
appear on enc0 interface if it is in use.

Am I wrong? Or is the Handbook wrong?

-- 
| pozdrawiam / greetings | powered by Debian, FreeBSD and CentOS |
|  Kajetan Staszkiewicz  | jabber,email: vegeta()tuxpowered net  |
|        Vegeta          | www: http://vegeta.tuxpowered.net     |
`------------------------^---------------------------------------'
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 195 bytes
Desc: This is a digitally signed message part.
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20170721/ba2bd7f5/attachment.sig>