Hi!

I encountered a strange behavior with IPSEC when doing the following:

I have two gateways, A (3.5 GENERIC#1 i386) and B (3.6 GENERIC#59 i386).

Between those two I have created simple security associations, as described 
in the vpn man page. I did not define any flows.

I can connect with SSH from A to B (or the other way round, doesn't matter), 
no problems.

However, when watching the packets on the wire, the first three packets of 
the SSH TCP connection are ALWAYS being sent plain, while the following 
packets are sent encapsulated.

(see attached tcpdump)

Do I miss something?

(Actually, I am also interested in why the packets get encrpyted at all, 
since there is no matching flow?)

Thanks,
Christian

========================================================

SA:

/sbin/ipsecadm new esp -src A.A.A.A -dst B.B.B.B \
        -forcetunnel -spi 1000 -enc aes -auth sha1 \
        -keyfile enc_key -authkeyfile auth_key

/sbin/ipsecadm new esp -src B.B.B.B -dst A.A.A.A \
        -forcetunnel -spi 1001 -enc aes -auth sha1 \
        -keyfile enc_key -authkeyfile auth_key

========================================================

tcpdump -n -i em0: (on B.B.B.B, while A.A.A.A is connecting with SSH, no 
other traffic)

03:50:49.059868 A.A.A.A.29567 > B.B.B.B.22: S 3890748540:3890748540(0) win 
16384 <mss 1404,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 1748988273 0> 
(DF)
03:50:49.059939 B.B.B.B.22 > A.A.A.A.29567: S 27341233:27341233(0) ack 
3890748541 win 16384 <mss 1460,nop,nop,sackOK,nop,wscale 0,nop,nop,timestamp 
915081925 1748988273> (DF)
03:50:49.104340 A.A.A.A.29567 > B.B.B.B.22: . ack 1 win 16384 
<nop,nop,timestamp 1748988273 915081925> (DF)
03:50:49.113965 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14520 len 116 (DF)
03:50:49.163055 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12115 len 116 (DF)
03:50:49.164906 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14521 len 740 (DF)
03:50:49.217896 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12116 len 708 (DF)
03:50:49.410039 esp B.B.B.B > A.A.A.A spi 0x00001001 seq 14522 len 100 (DF)
03:50:49.433388 esp A.A.A.A > B.B.B.B spi 0x00001000 seq 12117 len 116 (DF)