A basic checklist to establish a tunnel on Solaris 9:

* Setup SAs for standard transport mode between two "outside"
interfaces, this includes keysets, ipseckeys, ipnodes and
ipsecinit.conf
* Get the IPSec working between these two outsides, confirm via snoop
* Now that transport method is running between outsides, plumb up the
tunnel on both ends of the inside interfaces, using ifconfig
* Tunnel endpoints will be the existing inside interfaces VIA the
outside interfaces.  Tunnel endpoints will be "numberless" IP
addresses
* Bring it up and voila - instant tunnel between two Solaris hosts.

There - leaving a number of details out that should about summarize it

Anyone see any glaring holes with this?

For some reason, my tunnel just died and din't even write me a suicide
letter.  External IPSec is still working fine via AES.  But the tunnel
refuses to behave.  Unclear on how to run in debug/trace.  IKE inop,
it's all manual.

[ Post a follow-up to this message ]