<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1255">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.0.6603.0">
<TITLE>Linux VPN</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P DIR=LTR><FONT SIZE=2 FACE="Arial">Hi,</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">I'm interested in installing VPN into Linux system.</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">I have some concerns:</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">1. IPSEC and QoS - </FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">Is there a way to prevent QoS from reordering of IPSEC packets?</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">Disordering of packets is critical to IPSEC</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">If understand correctly (probably not) IPSEC handling is done within POST_ROUTING.</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">Traffic-shaping queues are attached to a device, which is done afterward.</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">2. IPSEC policy per interface.</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">Can packet be matched upon their in/out interface ?</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">I haven't seen that interface can be specified in any method of setting IPSEC rules</FONT></P>
<P DIR=LTR> <FONT SIZE=2 FACE="Arial">(e.g.<I> spdadd</I> in 2.6 native ipsec, or<I> ipsec</I><I> auto -add</I> in KLIPS of OpenSwan) </FONT></P>
<P DIR=LTR> </P>
<BR>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">Thanks,</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial">- Ido Goshen,</FONT></P>
<P DIR=LTR><FONT SIZE=2 FACE="Arial"> Avaya communications</FONT></P>
</BODY>
</HTML>