Subject: Re: port bound SAs

From: Patrick McHardy <[email-masked]>
Date: Tue, 27 Jan 2009 18:01:04 +0100

Paul Moore wrote:
> racoon
> 
> if I look at the xfrm/pfkey code in the kernel it ignores any ports sent
> down by the IKE daemon in transport mode. I actually changed the racoon
> code to include the ports and it makes no difference

Assuming you're also using setkey, try adding "unique" to your policies.