Subject: Re: [Ipsec-tools-devel] Re: [PATCH 2.6]: Check against correct policy list in ip_forward/ip6_forward

From: Aidas Kasparas <[email-masked]>
Date: Tue, 19 Oct 2004 18:57:19 +0300

Patrick McHardy wrote:
> Aidas Kasparas wrote:
> 
>> I'm sorry, what is wrong with racoon?
> 
> 
> When generate_policy is set to on racoon doesn't generate forward
> policies for tunnel mode SAs, so traffic forwarded from a tunnel
> is not subject to policy checks.

Patrick,

	what _forward_ policies should racoon generate. And WHY?!

Could you please specify for the case when:
- remote host has address A.A.A.A
- security gateway have insecure adress B.B.B.B
- secured network is C.C.C.0/24, security gateway's address C.C.C.C

what policies in your oppinion has to be inserted into SPD for this 
setup by racoon?

	Thanks in advance.

> 
> I have a patch which fixes this, I will post it a couple of days.
> 
> Regards
> Patrick
> 

-- 
Aidas Kasparas
IT administrator
GM Consult Group, UAB