As I am new to configuring VPNs, could you clarify why one of the VPN nodes is supposed to be set up in passive mode. I don't think that this is what you are saying but from reading your example I get that if one end is set up as passive that you can only reach network A from B and not reach network B from A. Could you please give any more info on what the passive function is supposed to handle.

also one other point, when are the isakmpd keys generated. They are obviously unique for each OpenBSD system right? I think I recal that these are generated on the first install.

Thanks.

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/infocus/1859/687#687