Re: reverse processing order: NAT, IPsec ?

[Thor Lancelot Simon <tls%rek.tjls.com@localhost>]

On Fri, Jun 12, 2009 at 03:14:34PM -0500, David Young wrote:
> 
> I don't see why there should be a profusion of interfaces if there isn't
> a profusion already for other reasons, such as a profusion of tunnel
> interfaces.

If you can get the amount of memory used by 5,000 tunnel interfaces down
to the amount of memory used by the datastructures for 5,000 tunnel-mode
IPsec SAs and SPD entries now, most of my concern goes away.  I guess it
would also be desirable to benchmark and see that it's no slower than the
current FAST_IPSEC implementation, under load, as well.

Thor