<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2180" name=GENERATOR></HEAD>
<BODY>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>I am setting up a
modified star config with 8 sites, but with IPSEC tunnels instead of traditional
frame/T1 circuits. I'll name the sites A through H. Site A is
in the middle and will have tunnels to all the other sites. So there will
be tunnels A-B, A-C, A-D, and so on. Depending on usage patterns, I will
also set up tunnels between other sites to make the network a partial
mesh. For example - if site B needs to communicate frequently to site E, I
could set up B-E and E-B tunnels. So the network will end up being a partial
mesh.</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>Site A, the middle
site, is split into two subnets - 10.44.1.nnn and 10.13.1.nnn. Site B
has one subnet, 10.15.1.nnn. I am running a proof of concept linking the
10.13.1.nnn LAN at site A with an IPSEC tunnel to site B and it
performs very well. </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>I am trying to
figure out some things:</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>1 - How to
route 10.44.1.nnn thru 10.13.nnn in site A across the IPSEC tunnel to
site B</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>2 - The best
way, in general, to route from any site through site A to any other
site.</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>3 - The best way to
dynamically calculate routes when I set up additional IPSEC tunnels, making the
network a partial mesh. </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>For (1) - I already
have IPSEC tunnels linking 10.13.1.nnn at site A with 10.15.1.nnn at site
B. Does it make the most sense to just set up another set of IPSEC tunnels
linnking 10.44.1.nnn with 10.15.nnn? </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>For (3), I am
guessing I want to set up a routing protocol such as OSPF using quagga? Or
would static routes with appropriate metrics be OK? </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>I've been reading
about setting up GRE tunnels over IPSEC and trying to understand how this makes
life better and I don't get it. Page 260 of Paul Wouters' Openswan book
discusses setting up GRE tunnels to reduce the number of IPSEC tunnels. So
in my case - let's say I want to "directly" connect sites D and E without
routing through A. (I know it isn't really direct because it's a
tunnel.) Would I set up D-E and E-D GRE tunnels? But that
doesn't make sense because I wouldn't have encryption for D-E traffic. I
would want IPSEC tunnels between D and E. How do GRE tunnels fit in?
How do GRE tunnels reduce the number of IPSEC tunnels?</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>Let's say
both F and G have a bunch of subnets behind their gateways.
In my case they don't, but let's say they do. Is this where GRE tunnels
come in? So I would do IPSEC F-G and G-F tunnels and then then GRE on top
of that and route all the subnets on both sides through the GRE
tunnel? </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>There is also a new
set of ip xfrm commands and it looks like these commands allow me to set some
sort of policy about what goes through IPSEC tunnels and what
doesn't. But this is different than OE policies - this looks like some
sort of routing policy? These might be useful with my 10.44.1.nnn routing
challenge. I studied everything I can find but have not been able to
find any documentation on what ip xfrm is all about or how to use it or if it is
relevant. Any documentation pointers? </FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2>thanks</FONT></SPAN></DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial
size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=067381005-28072006><FONT face=Arial size=2>- Greg
Scott</FONT></SPAN></DIV></BODY></HTML>