Hi all,

I'm looking for suggestions on how to proceed in configuring ipsec in
Slackware. I'm not necessarily looking for documentation (I've found it
in droves), but for ideas on how long each general route to ipsec might
take, and how difficult one path might be relative to the others. There
are certainly many options:

--Patch the 2.4 kernel, patch 2.6 with KLIPS, or use 2.6's native ipsec?
--Openswan, FreeS/WAN, ipsec-tools?

Mix-n-match to your delight (some options won't work, but most will),
and I've got quite a few choices. Right now I'm leaning towards native
2.6 ipsec with Openswan, but I don't have a lot of experience with 2.6.
OTOH, my last go with ipsec a few years back was with 2.4, and it didn't
go so well, so I'm wary there, too.

If it makes any difference, one end of the ipsec tunnel will (likely) be
an OS X Tiger box. I've seen less documentation on OS X <-> linux
ipsec, but enough that my options should not be too limited.

--keith


--
kkeller-usenet@wombat.san-francisco.ca.us
(try just my userid to email me)
AOLSFAQ=http://wombat.san-francisco.ca.us/cgi-bin/fom
see X- headers for PGP signature information

Hi Keith,

On Mon, 24 Oct 2005 23:04:05 -0700, Keith Keller wrote:
> --Patch the 2.4 kernel, patch 2.6 with KLIPS, or use 2.6's native ipsec?

I would go for the native 2.6 kernel IPsec implementation with the ported
KAME IPsec tools. The 2.6 implementation is similar to that in *BSD, and
the tools are equal (although OpenBSD does not use racoon). This
implementation is tried & tested, and is the standard IPsec implementation
of the future.

> If it makes any difference, one end of the ipsec tunnel will (likely) be
> an OS X Tiger box. I've seen less documentation on OS X <-> linux
> ipsec, but enough that my options should not be too limited.

IIRC Mac OS X has the KAME IPsec implementation, with the normal KAME
tools. If you use the native 2.6 stack and KAME ipsec tools, configuration
on Mac OS X and Linux will virtually be the same (setting up security
policies with setkey, and making security associations with the racoon IKE
daemon).

-- Daniel