I normally expect IP tunnels to be opaque , that is to act as if theywere physical links: the packet is sent down one end and pops out theother end unchanged, just as if it went over a connection betweentwo routers, and the tunnel itself is indifferent to the details ofthe packets it is transporting. (The technical ISO way of describingthis is that I expect IP tunnels to act entirely as layer 2 entities.)

However, one of the peculiarities of GRE is that itis a translucent

I just got IPSec doing exactly what I need it to do. Unfortunately itturns out not to do me any good.

The problem is with tunnel mode IPSec, which has a cascade of issues.First, IPSec tunnels don't create actual network devices. This soundsharmless, except that you need a network device to establish routesand thus say things like 'network foo/24 is reachable over this IPSectunnel'.

IPSec deals with this with black magic involving Security PolicyDescriptors. If you add an

One of the tricky bits of organizing a sufficiently large group ofmachines is avoiding circular dependencies in the machine startup order,so that you can actually bring your systems up after things like acomplete machine room power outage.

(In our case it was planned; the electricians wanted the master breakersoff before they played around in our breaker panel to give us more usablecircuits.)

Startup order dependencies come in a variety of flavours. The simpleone is a startup script that depends on another machine being up, forexample