|
Hi Julian,
OK, at least, we are one step forward:
http://www.linuxvirtualserver.org/~julian/LVS_IPSEC.txt
Holy sheep, Julian, where do you steal the time to write all those
documents. You write more than I can read in my spare time :)
o The initial connection setup where to SA pools for the IPsec endpoints
are generated is not encrypted. Your document says all ISAKMP traffic
is encrypted. This can't be the case. The keys to encrypt connection
are generated after the ISAKMP initial 'handshaking' where we
negatiate about SPI-pools, used crypto-hashes and lifetime and such.
We could theoretically be able to intercept and read that traffic.
o Could you extend the part with the "We don't need to maintain
connection entries ..."? You should add that if you have a fwmark for
0/0->VIP:500 that the ESP/AH packets need to be scheduled to the same
RS or the monkey won't fly. Actually I don't understand the whole
paragraph. Do you mean what I mean above? If you add ESP/AH to the
same template as fwmark'd VIP:500 then we're safe? I read the para-
graph below and if I read it correctly I think we both mean the same
thing :)
o Julian, how can an administrator configure a machine not to check the
TCP/UDP checksums?
Best regards,
Roberto Nibali, ratz
|
