Joshua Smith wrote:
quoted text
> Out of curiosity what are these two extremely rare cases?
[snip]

One example off the top of my head (and ipsec.conf(5)) is the enc0
interface.  You wouldn't set your state-policy to this, but each
individual rule would use if-bound to prevent traffic from going out
your egress when an IPsec SA is removed/expires before the state is
removed/expires (think isakmpd and the various reasons an SA can disappear).

Of course, if I am wrong and if-bound shouldn't be used in this case,
ipsec.conf(5) should be updated appropriately.

-Brian

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]