Re: linux-ipsec: More questions

> (Because SUSE has a somewhat different filesystem structure, the

Looks can be deceiving...

> ... "look" shows the following:

It sounds like "setup" did *not* in fact work correctly -- the ipsec0 interface has not been connected to eth0 properly. To confirm this, either "cat /proc/net/ipsec_tncfg" or "ipsec barf".

Note that ipsec_look is intended for situations where things are going well -- ipsec_barf is the weapon of choice for difficulties. Notably, if you are going to ask for help, please send ipsec_barf output, *not* ipsec_look output. Yes, it's bulky, but it goes to some lengths to capture everything that might be relevant in troubleshooting, and ipsec_look does not.

> Further, I wonder why packets in the one direction are of proto 51

That one's definitely weird, especially since the SAs would appear to be set up correctly.

> Btw: The terms "left" and "right" are really not very well chosen.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

The whole point of using "left" and "right" is that they do *not* differ from machine to machine. That's the main motive, not a side effect; changing to "local" and "remote" would defeat the objective, which is to make it possible to use identical control files on both ends. For that, the terms *have* to describe the network in an absolute way, not relative to one particular host. Possibly "left" and "right" are not the best; I considered several other possibilities but didn't find any I liked. If anyone has specific suggestions on better ones, I'd be interested.

                                                          Henry Spencer
                                                       henry@spsystems.net
                                                     (henry@zoo.toronto.edu)