IPSec script + question

[Hal Snyder <hal@vailsys.com>]

I've automated the process of creating manual-key startup scripts for
IPSec, shamelessly copying from OpenBSD's /usr/share/ipsec/rc.vpn.

The result is a perl CGI script. You can try it at
  http://www.enteract.com/~hal/ipsecgen.pl
and view source at
  http://www.enteract.com/~hal/ipsecgen.txt

Since the ipsecadm command is somewhat of a moving target, options to
enable/disable -local and -ingress options are individually selectable
for each peer. Configuration scripts are written directly into the
browser window because I didn't want to get into temp file issues at
the ISP account.


Now a question: Does OpenBSD IPSec support a remote DHCP client (with
SKIP this was called a "nomadic" client - the FreeS/WAN guys refer to
a "road warrior" mode) with manual or IKE keying? The IPSec FAQ
page and singlehost-east/-west examples in
/usr/src/sbin/isakmpd/samples suggest that a server doesn't need to
know in advance the IP address of a remote peer, but OTOH there
doesn't seem to be a simple way to configure the local part of an
IPSec tunnel dynamically.

If I missed this capability somehow, sample rc.vpn or isakmpd.conf
files would certainly help clear things up.
-- 
Hal Snyder
Vail Systems, Inc