I just got IPSec doing exactly what I need it to do. Unfortunately itturns out not to do me any good.

The problem is with tunnel mode IPSec, which has a cascade of issues.First, IPSec tunnels don't create actual network devices. This soundsharmless, except that you need a network device to establish routesand thus say things like 'network foo/24 is reachable over this IPSectunnel'.

IPSec deals with this with black magic involving Security PolicyDescriptors. If you add an

One of the tricky bits of organizing a sufficiently large group ofmachines is avoiding circular dependencies in the machine startup order,so that you can actually bring your systems up after things like acomplete machine room power outage.

(In our case it was planned; the electricians wanted the master breakersoff before they played around in our breaker panel to give us more usablecircuits.)

Startup order dependencies come in a variety of flavours. The simpleone is a startup script that depends on another machine being up, forexample

The Computer Science department has been using its primary machine roomfor at least 25 years, and it's a proper machine room, complete with araised floor. (People with the right sort of experience are now wincing.)

The problem is best illustrated by an anecdote: we just recently tookout some hybrid 208V plus 120V power circuits that we believe were putin to power old Vaxes (which would make them obsolete for going on 20years). We didn'