Hello, 
    I have set up a nice little gateway / router using FreeBSD. 
It works very nice so far.  I have a laptop running NetBSD.

    I desperatly need help with ipsec.  I have searched the
internet and read the faq's.  My problem is that I have not
found an easy way to tell if it is working.  I am guessing it is
not.

    Here is the setup.  

    3 interfaces:  xl0, xl1, wi0

    xl0 is the external interface. all trafic is natted through
this interface

    xl1 is the internal wired interface

    wi0 is the wireless interface

    xl1 -> xl0 works fine

    wi0 -> xl1 are bridged (sysctl
net.link.ether.bridge_cfg="wi0 xl1"), this also works fine

    I have enabled 128 bit wep, as a quick and dirty way of
getting the network 'somewhat' secure.  At least the data is not
in clear text.  There is little threat from a wireless hacker
here too, as there is not sufficient range (tested, much
concrete here)

     I now want to set up ipsec.  So I read the handbook, and
searched the net.

     Before ipsec
         ping wireless laptop to xl1 gives normal reply

     After ipsec
         ping wireless laptop to xl1 gives NO response

     I can access the internet though.  I run netstat -sn -p
ipsec on both machines and it seems that both are sending
outbound packets correctly 
 eg: 
     55 outbound packets processed successfully

      however I also see:
 eg:
     35 inbound packets with no SA available

    I want to secure traffic between xl1 and my laptop.  esp
would be fine, as I have read that you cannot use ah with natd. 
I also want to use ipcomp.

    The basic setup is:
ipsec.conf:
add <machine a ip> <machine b ip> esp 7000 -E <env type from man
pg) "the key";
add <machine b ip> <machine a ip> esp 17000 -E <env type from
man pg) "the key";
add <machine a ip> <machine b ip> ipcomp 7002 -C deflate;
add <machine b ip> <machine a ip> ipcomp 17002 -C deflate;
spdadd <machine a ip> <machine b ip> -P out esp/transport//use
ipcomp/transport//use;
spdadd <machine b ip> <machine a ip> -P in esp/transport//use
ipcomp/transport//use;

the difference are the spdadd's on the machines the client is
swithced the in and out statements.  This is what I have read.

So how do I tell is this is actually working, and why cannot I
ping the machine after starting ipsec?

Also shouldn't I be able to do this setup (bridging / nat) with
ipsec?

Thanks, 
Joe  

__________________________________________________
Do you Yahoo!?
Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
http://mailplus.yahoo.com