IPsec - got ESP going, but not AH

[Greg Troxel]

While this should probably work, it's more straightforward to use ESP
with integrity protection.  That is, use a -A hmac-sha1 argument also
to ESP.  (hmac-md5 is probably still fine, but sha1 goes better
strength-wise with rijndael-cbc.)

I believe that in tunnel mode AH and ESP integrity are essentially
identical - but read RFC2401 and rfc2401bis (i-d from ipsec wg) if you
really want to understand.  In transport mode, AH protects parts of
the original (and only) IP header.

-- 
        Greg Troxel <gdt at ir.bbn.com>