Re: IPsec - got ESP going, but not AH

While this should probably work, it's more straightforward to use ESP
with integrity protection.  That is, use a -A hmac-sha1 argument also
to ESP.  (hmac-md5 is probably still fine, but sha1 goes better
strength-wise with rijndael-cbc.)

I believe that in tunnel mode AH and ESP integrity are essentially
identical - but read RFC2401 and rfc2401bis (i-d from ipsec wg) if you
really want to understand.  In transport mode, AH protects parts of
the original (and only) IP header.

-- 
        Greg Troxel <[e-mail]>
_______________________________________________
[e-mail] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "[e-mail]"