Subject: RE: ipf-ipsec interaction
To: , <>
From: Bruce Martin <>
List: tech-net
Date: 03/13/2001 08:36:33
I am busy setting up an IPSec tunnel as well. Is the only solution here to
have two separate boxes as gateway stages, the outer one unpacking the
IPSec, and the inner one doing the IP Filtering and NAT?


-----Original Message-----
From: []On
Behalf Of
Sent: 13 March 2001 01:21
Subject: Re: ipf-ipsec interaction

>you mean ipf + ipnat?

	ipnat is part of ipf.

>So when just applying transport mode (with only esp)
>in the release branche shouldnt be a
>problem, even not with nat?

	for transport mode, there will be less problem.  the only problem
	i can think of is that, you cannot classify the following packet
	as "tcp packet" in ipf rule, since ipf does not chase header chain:
		IP AH TCP payload