vanhu at FreeBSD.org
Sat Mar 26 16:17:53 UTC 2011
On Fri, Mar 25, 2011 at 12:28:53PM -0400, Stephen Clark wrote:
> If one has multiple entries in the SPD some representing more specific
> network addresses not to be encrypted and sent over an
> ipsec tunnel vs more general networks that would be encrypted would this
> In other words say I have a x.x.0.0/16 that should encrypted but in that
> x.x.0.0/16 I don't want x.x.84.0/23
> to be encrypted could I do that? If so is dependent on the order the SPD
> entries are made?
Yes, SPD entries are ordered.
Just set up first specific SPD entries for traffic which must not be
encrypted, then the tunnel/transport entries for networks.
More information about the freebsd-stable