From mboxrd@z Thu Jan 1 00:00:00 1970 From: Grant Taylor Subject: Re: SNAT before IPSec Date: Wed, 06 Jun 2007 13:48:15 -0500 Message-ID: <4667016F.6070701@riverviewtech.net> References: <8bd3dfad0706050529s484d42b6t9ef4ae0fd1730367@mail.gmail.com> <4665C771.4040609@riverviewtech.net> <4665F77D.8050603@riverviewtech.net> Reply-To: gtaylor+reply@riverviewtech.net Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: netfilter-bounces@lists.netfilter.org Errors-To: netfilter-bounces@lists.netfilter.org Content-Type: text/plain; charset="us-ascii"; format="flowed" To: Mail List - Netfilter On 06/06/07 10:39, Jorge Davila wrote: > to be honest, reading, re-reading before the rfc the same doubt come > to my mind but now, my understanding is that the paragraph is really > doing reference to an interface to manage the traffic according to > the policies defined. *nod* I think the reason that network interfaces stopped being created was in preparation for MANY IPSec connections, enough so that creating network interfaces would just be a waste. If I recall correctly the IPSec people were wanting and hoping to start seeing IPSec used arbitrarily any time that it could be used, including accessing web pages off of web servers. In this case, creating and removing interfaces is just (IMHO) ridiculing. Grant. . . .