Re: IPsec vs ssh

[Darren Reed <darrenr%netbsd.org@localhost>]

On 12/11/2013 12:37 PM, Greg Troxel wrote:
> 
> Darren Reed <darrenr%netbsd.org@localhost> writes:
> 
>> The man page for setkey seems to suggest that there is a priority
>> mechanism that would allow me to create a "none" SPD for ssh
>> packets but setkey on NetBSD doesn't support this. If I understand
>> correctly, if it was present then I would do something like this:
>>
>> spdadd A.B.C.D/32 E.F.G.0/24 any -P in priority low ipsec
>> esp/tunnel/A.B.C.D-E.F.G.H/require;
>> spdadd E.F.G.0/24 A.B.C.D/32 any -P out priority low ipsec
>> esp/tunnel/E.F.G.H-A.B.C.D/require;
>> spdadd A.B.C.D/32[22] E.F.G.0/24[any] tcp -P in priority high none;
>> spdadd E.F.G.0/24[any] A.B.C.D/32[22] tcp -P out priority high none;
> 
> I have only skimmed this rather huge (and surprisingly contentious)
> thread.
> 
> Two points about your policies:
> 
>   They have to match on both ends, inversely.

When NAT is involved and NetBSD is behind the NAT device, how can they?

Darren