IPSec tunnel interfaces (was: freebsd vpn server behind nat dsl router)

[Jeremie Le Hen]

Hi Yvan,

On Wed, Mar 07, 2007 at 06:06:17PM +0100, VANHULLEBUS Yvan wrote:
> - FreeBSD handbook talks about Gif interfaces for IPSec tunnels. Just
>   forget that part and use directly IPSec tunnels without Gif
>   interfaces.

While I understand why using gif(4) to create IPSec tunnels is
not recommended because of interoperability, administratively it
is pretty useful to see the tunnel as an interface.  Everything
that comes along such as routes, firewall rules et al work very
naturally.  I'm no IPSec expert as you probably are and I seem
to recall the RFC advises (requires ?) it to be implemented as a
bump in a stack.  However, is it reasonable to expect to see
this in the future ?

It seems the enc(4) interface provides this feature somehow but
only for FAST_IPSEC.  What is the doom of IPSEC ?  Are they to
be merged in the future, or is it possible to make the enc(4)
work with IPSEC as well ?

Thank you.
Regards,
-- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >