[Users] Re: [Design] mast(4)

On 03/14/2003 02:34 PM, Jim Carter wrote:

> warrior <-------> NATbox <-----> ipsec-GW <-----> anywhere
> 192.168.0.1/32 4.3.2.1 | 128.97.4.250
> warrior2 <------> NATbox2 <----|
> 192.168.0.1/32 5.6.7.8
>
> >Isn't this just the usual IPsec NAT-traversal situation?

OK, I understand the question now.

This could also be well handled using present-day technology, in tunnel mode.

OTOH if the warriors are too dumb to give themselves distinct private side addresses (also known as virtual IPs) -- perhaps because they are using transport mode -- then you've got a problem.

The technique of letting the IPsec gw arbitrarily impute a private-side address each warrior, as proposed in http://www.monmouth.com/~jsd/vpn/ipsec+routing/mast.htm#sec-transport-pvt

should help a lot, as Jim observed earlier.

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related lists.freeswan.org Links 1998-fall 1998-spring 1998-summer 1998-winter 1999-winter announce briefs bugs design freeswan-list hipsec ietf-sectest users users-admin Request more information about Pantek

We can call this a "transport-mode private IP address" or "transport-mode virtual IP address".