tech-net archive

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]

Re: NetBSD IP security in practice

Hi Erik-san,

I'm using IP security in router product based on NetBSD.

> Who among us is using IP security in practice (production)?
> Are you using it just for VPN/tunneling, or in transport mode?

I'm using it for 

 1. IPsec-VPN (many use cases, simple ESP tunnel)
 2. L2TP-VPN (many use cases, L2TP tunnel + ESP transport)
 3. Secure Logging (sometimes, syslog + ESP transport)

I feel 99% of use cases are tunneling.

> How well does it perform?

I'm using "options IPSEC", it is KAME IPsec implementation.
"options FAST_IPSEC" should be better than KAME.

Interoperability of AH and ESP is fine.

Throughput (bps or pps) is not fine. I think throughput problem
is not caused by IPsec itself, IP stack is slower than other
implementation today. Especially, throughput of NetBSD IP stack
is slower on SMP environment.

I'm using /usr/sbin/racoon (and many local hacks) for key exchange,
but raccoon is too old implementation. There are some newer and
better implementation of IKE. I think replacing old racoon is happy.

> What quirks does it have?

Lookup of SPDB and SADB become slower when using large DB.
If you use many numbers of transport mode IPsec communications,
or concentrate many numbers of VPN tunnels, this may causes troubles.
some LIST_FOREACH() spends very long time.

Workings of phil_run_hook() cause a misunderstanding when using
combination of some tunneling protocol and transport mode IPsec.
Filters don't works for decapsulated(inner) packet. For example,
if you use gif tunnel and transport mode IPsec, filters for gif
may not work. see ipsec.c line 550 for detail. I think reconsiderations
for filtering manners for packets which encapsulated using IPsec.

> How does our documentation stack up? Was it clear enough by itself, or did 
> you have to consult other sources to get IP security to work on NetBSD?

man pages are good enough for programmer's view.
I don't know about documentations for network users.

Internet Initiative Japan Inc.

Product Technology Section,
Product Development Division,
SEIL Business Unit

SUENAGA Hiroki <>

Attachment: smime.p7s
Description: S/MIME cryptographic signature

Home | Main Index | Thread Index | Old Index