Re: Modefg considered harmful

["Scott G. Kelly" <scott@bstormnetworks.com>]

Hi Darren,

Darren Dukes wrote:
> 
> Actually with this scenario a DHCP relay within the RemoteOfficeLAN instead
> of on the SmallIPsecGW would likely be the implementation of choice.
> RFC3456 does not say anything about the relay being on the inside LAN
> interface, only the interface terminating IKE-SAs so I don't think it could
> be applied to this scenario.

Actually, you could either relay from the inside of the remote lan
alone, or from there *and* from the head-end sgw. The benefit of the
second configuration would be that in such cases, the remote lan need
not be aware of the IP address of the dhcp relay destination. In any
event, the tunnel must either support 0/0 selectors, or there must be a
separate tunnel for the dhcp packets. 

You are correct that the rfc does not explicitly call out this
configuration. It probably should.

Scott