Re: linux-ipsec: Another draft effort: vpn mini-howto

This looks useful.

| ... A class C address uses only 8 bits for the

               A
| network and 24 for the host, so you get 10.0.0.0/8 to identify a class C

                                                                          A

One thing I'd look for in a howto is some characterization of how effective, convenient, and trustable the system is. This would help people quickly decide if FreeS/WAN is worth looking at, now, or later.

I think Pluto is still fragile in use. For example, it doesn't rekey, and it doesn't recover from a security gateway restart. Perhaps you should warn people not to expect a robust solution (yet).

Another thing that makes me shiver is that Pluto naively believes its peer's claim of representing a subnet (consider the claim 0.0.0.0/0!). This means that the network administrator must trust both security gateways.

Hugh Redelmeier
hugh@mimosa.com voice: +1 416 482-8253 Received on Wed Sep 2 19:49:52 1998