Appendix G - IPSEC
User Guide
381
For each left* parameter, there is a corresponding right* parameter.
Note that a connection to a subnet behind left does not include left itself. The tunnel
described above protects packets going from one subnet to the other. It does not apply to
packets which either begin or end their journey on one of the gateways. If you need to pro-
tect those packets, you must build separate tunnel descriptions for them.
It is a common error to attempt testing a subnet-to-subnet connection by pinging from one of
the gateways to the far end or vice versa. This does not work, even if the connection is func-
tioning perfectly, because traffic to or from the gateway itself is not sent on that connection.
If you want to protect traffic originating or terminating on the gateway, then you need a sepa-
rate tunnel for that in addition to the subnet's tunnel.
Leftnexthop
Where left should send packets whose destination is right, typi-
cally the first router in the appropriate direction. This need not
always be se., If the two gateways are directly linked (packets can
go from one to the other without IP routing by any intermediate
device) then you need not set either leftnexthop or right-
nexthop. A connection with left=%defaultroute or
right=%defaultroute must not have the corresponding nexthop
parameter set. However, in all other cases, you must provide
nexthop information. KLIPS bypasses the normal routing machin-
ery, so you must give KLIPS the information even though routing
already knows it.
leftsubnet
Addresses for the machines that left is protecting. Often
something like 101.202.203.0/24 to indicate that a subnet resides
behind left. Often this subnet will be directly connected to left,
but this not necessary. The only requirement is that left must be
able to route to it. If you omit the leftsubnet line, then left is both
the security gateway and the only client on that end.
auto
If the conn setup section has plutoload=%search, then all
connections marked auto=add are loaded when Pluto starts. If
the conn setup section has plutostart=%search, then all
connections marked auto=start are started when Pluto starts.
Initially, we suggest using auto=add on all connections. This lets
you start them manually during testing. Once they are tested, you
can change many of them to auto=start.
