Re: mast(4)

I wrote:

| http://www.monmouth.com/~jsd/vpn/ipsec+routing/mast.htm

On 03/12/2003 01:50 PM, D. Hugh Redelmeier wrote:

> Nice document!

:-)

> BTW, in KLIPS 1, ipsecN devices can be bound to alias devices.

Good point.

Upon reflection, I ripped out essentially all references
to "physical device" and replaced them with "raw device".

This thought has wider implications.

For example, consider the current command
   ipsec tncfg --attach --virtual ipsec$N --physical $yyy

The raw device $yyy need not really be physical. It
could perfectly well be a virtual device such as gre0.
Yes, ipsec$N is a virtual device, but that's not what
distinguishes it from the raw device.

Obviously it's not worth revising tncfg since a major
goal of KLIPS-ng is to get rid of the whole idea of
"attachment" between ipsec devices and anything else.

But we should make a conscious effort to say "raw
device" and keep the notion of "physical device" out
of the KLIPS-ng documentation.

==================================

I added an appendix

http://www.monmouth.com/~jsd/vpn/ipsec+routing/mast.htm#sec-transport-pvt

which discusses the somewhat esoteric issue of how to
assign private-side addresses to transport-mode connections
on a mast device.