procedures for a Solaris tunnel

Archived from groups: comp.dcom.vpn (More info?)

A basic checklist to establish a tunnel on Solaris 9:

* Setup SAs for standard transport mode between two "outside"
interfaces, this includes keysets, ipseckeys, ipnodes and
ipsecinit.conf
* Get the IPSec working between these two outsides, confirm via snoop
* Now that transport method is running between outsides, plumb up the
tunnel on both ends of the inside interfaces, using ifconfig
* Tunnel endpoints will be the existing inside interfaces VIA the
outside interfaces. Tunnel endpoints will be "numberless" IP
addresses
* Bring it up and voila - instant tunnel between two Solaris hosts.

There - leaving a number of details out that should about summarize it

Anyone see any glaring holes with this?

For some reason, my tunnel just died and din't even write me a suicide
letter. External IPSec is still working fine via AES. But the tunnel
refuses to behave. Unclear on how to run in debug/trace. IKE inop,
it's all manual.