Allow creating "not" rules for IPsec Phase 2
We should have the ability in Phase 2 to negate the action ("none" in the SPD) so that specific traffic can be made to not enter an IPsec tunnel.
Somewhat related to #3328 (reordering P2 entries) so these exceptions can be moved above the other entries as needed.
These entries would not need to have any encryption options chosen, only the networks defined.
#4 Updated by Markus Stockhausen about 2 years ago
This feature wil be really helpful. Lets assume a office firewall connected to a HQ firewall. It serves sub multiple small subnets via different interfaces. Lets assumes these are 10.11.12.0/24 (LAN) and 10.20.30.0/24 (OPT1). To build a working routing one would need tens of SAs and build them around the subnets.
A simple implementation could be a single checkbox for each SA. If it is set the local SA part will create a shunt entry in ipsec.conf
#6 Updated by NCATS LAB about 1 year ago
Strongly Request feature.
We just lost a lot of time because this isn't implemented on SG-4860s.
On our REMOTE SG-4860, we has set up bridging for OPT1-OPT4 and couldn't figure out why everything worked to the GATEWAY except testing the DEF GW with PING.
System should be flexible enough to allow IPSEC tunnels on any interface without some background rule that only makes exceptions on LAN.