Re: typical IPsec-based VPNs incl. modecfg vs. DHCP

["Scott G. Kelly" <scott@airespace.com>]

BSingh@Nomadix.com wrote:
<trimmed...> 
> But I guess this is not what RFC2401 says and it leaves it open for various
> implementations to have different SPD methodology.. Can you update me on
> what other ways SPD entries are looked up for tunnel selection.. I am more
> interested in the source address or some source parameter being included as
> the criteria for tunnel selection or an SPD interface that lets me make
> policies based on the source of the packets.. Is it possible? If you can
> guide me there I would really appreciate it..

I think RFC2401 is quite explicit about what selectors are used in SPD
lookups. Based on this, the virtual interface approach suffers from (at
least) two problems: first, routing lookups are most specific to least
specific (i.e. "best match"), meaning the administrator may not be able
to strictly control the ordering of SPD elements. Secondly, it does not
support protocol and/or ports as selectors.

Scott