Re: more: NAT through encryption interface

2006-07-05 Thread Stephen Bosch
Matthew Closson wrote: > In setting up about 30 ISPEC tunnels on an OpenBSD box in the past 6 > months I had this issue come up with about 4 of the remote peers. > Typically it is one of two problems. > > 1. They have a made a policy level decision somewhere and say they will > only route traffic

Re: more: NAT through encryption interface

2006-07-04 Thread Stephen Bosch
Matthew Closson wrote: > On Tue, 4 Jul 2006, Stephen Bosch wrote: > >> Stephen Bosch wrote: >>> Hi, all: >>> >>> I am configuring an IPsec tunnel like so: >>> >>> local_internal_IP -> alias_IP ->remote_peer_IP -> remote_internal_IP >>> local host | openBSD | Cisco PIX |remote intern

Re: more: NAT through encryption interface

2006-07-04 Thread Stephen Bosch
Matthew Closson wrote: > I don't think what you want to do is currently possible: > > Here is your problem: > > Let's say you have these settings > > internal_host 10.0.0.5 > internal_openbsd_nic 10.0.0.1 > external_openbsd_nic AAA.AAA.AAA.AAA > > Remote_concentrator BBB.BBB.BBB.BBB > Remote_i

Re: more: NAT through encryption interface

2006-07-04 Thread Matthew Closson
On Tue, 4 Jul 2006, Stephen Bosch wrote: Stephen Bosch wrote: Hi, all: I am configuring an IPsec tunnel like so: local_internal_IP -> alias_IP ->remote_peer_IP -> remote_internal_IP local host| openBSD | Cisco PIX | remote internal host alias_IP is a carp alias. It is one end

Re: more: NAT through encryption interface

2006-07-04 Thread Stephen Bosch
Stephen Bosch wrote: > Hi, all: > > I am configuring an IPsec tunnel like so: > > local_internal_IP -> alias_IP ->remote_peer_IP -> remote_internal_IP > local host | openBSD | Cisco PIX | remote internal host > > alias_IP is a carp alias. It is one end of an IPsec security > associat

more: NAT through encryption interface

2006-07-04 Thread Stephen Bosch
Hi, all: I am configuring an IPsec tunnel like so: local_internal_IP -> alias_IP ->remote_peer_IP -> remote_internal_IP local host| openBSD | Cisco PIX | remote internal host alias_IP is a carp alias. It is one end of an IPsec security association. netstat -rn gives this (altered)