Re: Disabling Policy Groups

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "Claudia" == Claudia Schmeing <[email protected]> writes:
    Claudia> In your experience, would it help to have mynet= setting(s) in
    Claudia> conn 
    Claudia> %default? These might define subnet/s which would use the
    Claudia> gateway's own policy 
    Claudia> groups for their own configs.

  Well, three problems that I can see with this:
	1) the implicit conns do not reference %default.
	2) if we put it in %default, it would affect all conns, including
	   the "self" conns.
	3) we may be doing OE for multiple subnets, so we really need a list.

  What I'd prefer to have is an implicit conn that looks like:

conn private
	type=tunnel
	left=%defaultroute
	leftsubnet=%opportunisticsubnet
	leftrsasigkey=%dnsondemand
	rightrsasigkey=%dnsondemand
	right=%opportunisticgroup
	failureshunt=drop
	auto=route
	also=OEdefault

  Where %opportunisticsubnet is like %opportunisticgroup, except that it
reads a set of CIDRs from, say, /etc/ipsec.d/networks/private. The files,
if empty, need to contain the equivalent of %defaultroute for
"private-or-clear" group, i.e. just myself.

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email protected] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPlGAeoqHRg3pndX9AQEO4gQAz7sxnIupl5krUeT8hA3YzoolGe5WD2cd
WE60YttxRuJrRAe8AIHn/pyWwSTtVpBfah1QbHEfGJaFDQmocCq0AvYpXtIlISDJ
J4HteOH25JWibh0OTVC6f9/kQGzaQAywhDEkQvyNQsfI/zY7sPc1JmJQZrjRc8R1
4qxm2cZ+pvo=
=mL0X
-----END PGP SIGNATURE-----