[strongSwan] Transport mode - specific ports only
james.masson at jmips.co.uk
Wed Mar 6 10:57:40 CET 2019
I've got a working configuration for a collection of servers using
transport mode to encrypt only a subset of ports, using strongswan 5.7.2-1 .
However, it seems suboptimal, because the servers are generating and
deleting new SAs every few seconds - I presume for every client port <>
server port pair ? The traffic on these ports is UDP, so there would be
massive overhead in doing this.
Can anybody point out a flaw in or improvements to my config?
To be clear, I'm after a config that does crypto negotiation once per IP
pair, but only encrypts traffic to/from a particular set of ports.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users