Return to racoon.conf.in CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon / samples

Annotation of embedaddon/ipsec-tools/src/racoon/samples/racoon.conf.in, revision 1.1.1.1

1.1       misho       1: # $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
                      2: 
                      3: # "path" affects "include" directives.  "path" must be specified before any
                      4: # "include" directive with relative file path.
                      5: # you can overwrite "path" directive afterwards, however, doing so may add
                      6: # more confusion.
                      7: path include "@sysconfdir_x@/racoon";
                      8: #include "remote.conf";
                      9: 
                     10: # the file should contain key ID/key pairs, for pre-shared key authentication.
                     11: path pre_shared_key "@sysconfdir_x@/racoon/psk.txt";
                     12: 
                     13: # racoon will look for certificate file in the directory,
                     14: # if the certificate/certificate request payload is received.
                     15: path certificate "@sysconfdir_x@/cert";
                     16: 
                     17: # "log" specifies logging level.  It is followed by either "notify", "debug"
                     18: # or "debug2".
                     19: #log debug;
                     20: 
                     21: # "padding" defines some padding parameters.  You should not touch these.
                     22: padding
                     23: {
                     24:        maximum_length 20;      # maximum padding length.
                     25:        randomize off;          # enable randomize length.
                     26:        strict_check off;       # enable strict check.
                     27:        exclusive_tail off;     # extract last one octet.
                     28: }
                     29: 
                     30: # if no listen directive is specified, racoon will listen on all
                     31: # available interface addresses.
                     32: listen
                     33: {
                     34:        #isakmp ::1 [7000];
                     35:        #isakmp 202.249.11.124 [500];
                     36:        #admin [7002];          # administrative port for racoonctl.
                     37:        #strict_address;        # requires that all addresses must be bound.
                     38: }
                     39: 
                     40: # Specify various default timers.
                     41: timer
                     42: {
                     43:        # These value can be changed per remote node.
                     44:        counter 5;              # maximum trying count to send.
                     45:        interval 20 sec;        # maximum interval to resend.
                     46:        persend 1;              # the number of packets per send.
                     47: 
                     48:        # maximum time to wait for completing each phase.
                     49:        phase1 30 sec;
                     50:        phase2 15 sec;
                     51: }
                     52: 
                     53: remote anonymous
                     54: {
                     55:        exchange_mode main,aggressive;
                     56:        doi ipsec_doi;
                     57:        situation identity_only;
                     58: 
                     59:        my_identifier asn1dn;
                     60:        certificate_type x509 "my.cert.pem" "my.key.pem";
                     61: 
                     62:        nonce_size 16;
                     63:        initial_contact on;
                     64:        proposal_check strict;  # obey, strict, or claim
                     65: 
                     66:        proposal {
                     67:                encryption_algorithm 3des;
                     68:                hash_algorithm sha1;
                     69:                authentication_method rsasig;
                     70:                dh_group 2;
                     71:        }
                     72: }
                     73: 
                     74: remote ::1 [8000]
                     75: {
                     76:        #exchange_mode main,aggressive;
                     77:        exchange_mode aggressive,main;
                     78:        doi ipsec_doi;
                     79:        situation identity_only;
                     80: 
                     81:        my_identifier user_fqdn "sakane@kame.net";
                     82:        peers_identifier user_fqdn "sakane@kame.net";
                     83:        #certificate_type x509 "mycert" "mypriv";
                     84: 
                     85:        nonce_size 16;
                     86:        lifetime time 1 min;    # sec,min,hour
                     87: 
                     88:        proposal {
                     89:                encryption_algorithm 3des;
                     90:                hash_algorithm sha1;
                     91:                authentication_method pre_shared_key;
                     92:                dh_group 2;
                     93:        }
                     94: }
                     95: 
                     96: sainfo anonymous
                     97: {
                     98:        pfs_group 2;
                     99:        encryption_algorithm 3des;
                    100:        authentication_algorithm hmac_sha1;
                    101:        compression_algorithm deflate;
                    102: }
                    103: 
                    104: sainfo address 203.178.141.209 any address 203.178.141.218 any
                    105: {
                    106:        pfs_group 2;
                    107:        lifetime time 30 sec;
                    108:        encryption_algorithm des;
                    109:        authentication_algorithm hmac_md5;
                    110:        compression_algorithm deflate;
                    111: }
                    112: 
                    113: sainfo address ::1 icmp6 address ::1 icmp6
                    114: {
                    115:        pfs_group 3;
                    116:        lifetime time 60 sec;
                    117:        encryption_algorithm 3des, blowfish, aes;
                    118:        authentication_algorithm hmac_sha1, hmac_md5;
                    119:        compression_algorithm deflate;
                    120: }
                    121: