FAST_IPSEC NAT-T support

[Larry Baird]

On Fri, Sep 15, 2006 at 12:07:58PM -0400, Scott Ullrich wrote:
> On 9/15/06, Larry Baird <lab at gta.com> wrote:
> > On Thu, Sep 14, 2006 at 09:43:38PM -0400, Scott Ullrich wrote:
> > > On 9/14/06, Larry Baird <lab at gta.com> wrote:
> > > > Please find attached two patches for adding FAST_IPSEC NAT-T support to
> > > > FreeBSD 6.x.  The patch "freebsd6-fastipsec-natt.diff" is dependent
> > > > upon Yvan's IPSEC NAT-T patch "freebsd6-natt.diff" which can be found at
> > > > http://ipsec-tools.cvs.sourceforge.net/ipsec-tools/htdocs/.  The second
> > > > patch "freebsd6-ipsec-fastipsec-natt.diff" is a cumulative patch
> > > > combining both patches together.
> 
> Great, thanks!
> 
> Next problem that I have encountered (with FAST_IPSEC) is:
> 
> # /sbin/setkey -D
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> Invalid extension type
> 
> Let me know if I can do any further testing, still waiting for status
> reports from a few of the pfSense users, but IPSEC seems to work okay
> even with this small cosmetic setkey issue.
Just to be sure I understand the issue.  You have a kernel built
with the FAST_IPSEC NAT-T patches but without the IPSEC_NAT_T option.
Your VPNs work but you are unable to dump your SAD entries.

Larry


-- 
------------------------------------------------------------------------
Larry Baird                        | http://www.gta.com
Global Technology Associates, Inc. | Orlando, FL
Email: lab at gta.com                 | TEL 407-380-0220, FAX 407-380-6080