Re: revised IPsec processing model

[Mark Duffy <mduffy@quarrytech.com>]

Yes Scott, that is exactly right.
But again, this was just an example of one situation where one would want 
to decouple the choice of SPD from the choice of exit interface.

--Mark

At 08:40 AM 8/1/2003 -0700, Scott G. Kelly wrote:
>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Hi Mark,
>
>I'm doing my best to try to understand, but email is a difficult medium
>for conveying complex ideas, so please bear with me while I try to sort
>this out. Given the following picture
>
>~               +---------------+
>~               |               |             +------+
>~ [host a]------|[if0]     [if1]|_____________|      |
>~               |  |         |  |_____________| SGW2 |---[host b]
>~               |[spd0]   [spd1]| tunnel      |      |
>~               +---------------+             +------+
>
>I think you're saying that you want the policy rule causing traffic
>from host a to host b to be tunneled to live in spd0 instead of spd1. Is
>this right?
>
>Scott