[Swan] IPsec PFP support on linux
Sowmini Varadhan
sowmini.varadhan at oracle.com
Tue May 2 14:05:26 UTC 2017
On (05/02/17 09:58), Paul Wouters wrote:
> I think you want to use Opportunistic IPsec, eg see
> https://libreswan.org/wiki/HOWTO:_Opportunistic_IPsec
I dont think that what I want is opportunistic ipsec..
taking an extreme example, I can set up the ipsec tunnels with
esp-null for *.5001 and 5001.* (and that's how I'm able to
trigger quick mode in my experiment).
But I want each 5-tuple to/from 5001 to get its own SPI. That
is not happening in my case.
If I used OE, I would *never* get a per-5-tuple SPI, right?
(I can give this a try later today but the rfc definition of OE is
not what I have in mind- I really want PFP, not OE).
> Note that IKEv2 also allows you to define one connection and instantiate
> a connection based on the trigger packet whose src/dst proto/port are
> included in the IKEv2 packet as traffic selectors. See RFC7296 and
> "narrowing".
yes, the rfc's permit this, I'm not sure how to set up my
SPD for this though.
More information about the Swan
mailing list