[Design] ipsec.conf alsoflip=

-----BEGIN PGP SIGNED MESSAGE-----
There are a number of useful tricks in writing ipsec.conf files.

One of them is to use the also= option to build conns in a modular way.

Consider n networks that will be used in a VPN. Each node's ipsec.conf needs up to n-1 conns describing its connections with others. One convenient trick is to distribute a file with a conn for each network, specifying only that network (leaving out the other side). By convention, make that system "right" (mnemonic: "remote" also starts with r).

Each SG would have its own ipsec.conf with a (partial) conn defining itself as left (like "local", it starts with l). Then there would be a conn for each connection:

conn joe-to-fred

	also=joe-as-left
	also=fred-as-right

The VPN need not be a complete graph for this approach to work.

There is one minor annoyance. Each system must be described somewhere as a left and somewhere as a right. I've added a new option to elmiminate this redundancy: alsoflip.

alsoflip can be used just like also. The only difference is that everything that gets merged into the conn via alsoflip is exchanged left for right.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

conn joe-to-fred

	alsoflip=joe
	also=fred

Claudia: do you need to document this? I've described it in ipsec.conf(5).

Hugh Redelmeier
hugh@mimosa.com voice: +1 416 482-8253

-----BEGIN PGP SIGNATURE-----
Version: 2.6.3ia
Charset: noconv

iQCVAwUBPoEY7MFAuQPManGZAQFZLQP+NV7u35x7tE6ydhlNVRdxlIaUu6xW9K9J /G3ugnoOKrFFbBd3Ys6AkkjCmL76RroEDTdcJV4YZ6v+MWzeDdbsEuI88XV54Sta d6jwNTCMKBK6B5zJdIFfnCBb4NRwReA9A5dHrgQAs6f4pNUOv5WZxEg3t5DrDNhT YHjZSD89638=
=PF8m
-----END PGP SIGNATURE-----