(racoon 811) Re: Address range in spdadd

At Mon, 18 Oct 2004 09:56:38 -0500,
"Nguyen, Thuan (EXP N-EKD Systems)" <[email protected]> wrote:
> 
> I wanted to use source/destination address ranges in spdadd but got
> errors. Here's the command I used:
> 
> spdadd 10.10.16.13-10.10.16.14 10.10.26.13-10.10.26.24 udp -P out ipsec
> esp/tunnel/10.1.14.3-10.1.24.3/require

see setkey(8).

If the above address ranges are the real ones, you can't avoid
4 spdadds.

The syntax of spdadd is:

	spdadd [-46n] src_range dst_range upperspec policy;

and src_range/dst_range is:

	address
	address/prefixlen
	address[port]
	address/prefixlen[port]

so you need to represent "10.10.16.13-10.10.16.14" and
"10.10.26.13-10.10.26.24" in "address/prefixlen" form.
But the problem here is that neither of them can't be represented
in one "address/prefixlen" form,
therefore you need 4 spdadds.
(BTW, if 10.10.26."24" were not a typo of "14", you'd need
at least 8 spdadds.)

-- 
KAMADA Ken'ichi <[email protected]>