Return to racoon.conf.sample-natt CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / ipsec-tools / src / racoon / samples

Annotation of embedaddon/ipsec-tools/src/racoon/samples/racoon.conf.sample-natt, revision 1.1.1.1

1.1       misho       1: # Id: racoon.conf.sample-natt,v 1.5 2005/12/13 16:41:07 vanhu Exp
                      2: # Contributed by: Michal Ludvig <mludvig@suse.cz>, SUSE Labs
                      3: 
                      4: # This file can be used as a template for NAT-Traversal setups.
                      5: # Only NAT-T related options are explained here, refer to other 
                      6: # sample files and manual pages for details about the rest.
                      7: 
                      8: path include "/etc/racoon";
                      9: path certificate "/etc/racoon/cert";
                     10: 
                     11: # Define addresses and ports where racoon will listen for an incoming
                     12: # traffic. Don't forget to open these ports on your firewall!
                     13: listen
                     14: {
                     15:        # First define an address where racoon will listen 
                     16:        # for "normal" IKE traffic. IANA allocated port 500.
                     17:        isakmp 172.16.0.1[500];
                     18: 
                     19:        # To use NAT-T you must also open port 4500 of 
                     20:        # the same address so that peers can do 'Port floating'.
                     21:        # The same port will also be used for the UDP-Encapsulated 
                     22:        # ESP traffic.
                     23:        isakmp_natt 172.16.0.1[4500];
                     24: }
                     25: 
                     26: 
                     27: timer
                     28: {
                     29:        # To keep the NAT-mappings on your NAT gateway, there must be
                     30:        # traffic between the peers. Normally the UDP-Encap traffic
                     31:        # (i.e. the real data transported over the tunnel) would be
                     32:        # enough, but to be safe racoon will send a short
                     33:        # "Keep-alive packet" every few seconds to every peer with
                     34:        # whom it does NAT-Traversal.
                     35:        # The default is 20s. Set it to 0s to disable sending completely.
                     36:        natt_keepalive 10 sec;
                     37: }
                     38: 
                     39: # To trigger the SA negotiation there must be an appropriate 
                     40: # policy in the kernel SPD. For example for traffic between 
                     41: # networks 192.168.0.0/24 and 192.168.1.0/24 with gateways 
                     42: # 172.16.0.1 and 172.16.1.1, where the first gateway is behind 
                     43: # a NAT which translates its address to 172.16.1.3, you need the 
                     44: # following rules:
                     45: # On 172.16.0.1 (e.g. behind the NAT):
                     46: #     spdadd 192.168.0.0/24 192.168.1.0/24 any -P out ipsec \
                     47: #            esp/tunnel/172.16.0.1-172.16.1.1/require;
                     48: #     spdadd 192.168.1.0/24 192.168.0.0/24 any -P in ipsec \
                     49: #            esp/tunnel/172.16.1.1-172.16.0.1/require;
                     50: # On the other side (172.16.1.1) either use a "generate_policy on"
                     51: # statement in the remote block, or in case that you know 
                     52: # the translated address, use the following policy:
                     53: #     spdadd 192.168.1.0/24 192.168.0.0/24 any -P out ipsec \
                     54: #            esp/tunnel/172.16.1.1-172.16.1.3/require;
                     55: #     spdadd 192.168.0.0/24 192.168.1.0/24 any -P in ipsec \
                     56: #            esp/tunnel/172.16.1.3-172.16.1.1/require;
                     57: 
                     58: # Phase 1 configuration (for ISAKMP SA)
                     59: remote anonymous
                     60: {
                     61:        # NAT-T is supported with all exchange_modes.
                     62:        exchange_mode main,base,aggressive;
                     63: 
                     64:        # With NAT-T you shouldn't use PSK. Let's go on with certs.
                     65:        my_identifier asn1dn;
                     66:        certificate_type x509 "your-host.cert.pem" "your-host.key.pem";
                     67: 
                     68:        # This is the main switch that enables NAT-T.
                     69:        # Possible values are:
                     70:        #   off - NAT-T support is disabled, i.e. neither offered,
                     71:        #         nor accepted. This is the default.
                     72:        #    on - normal NAT-T support, i.e. if NAT is detected 
                     73:        #         along the way, NAT-T is used.
                     74:        # force - if NAT-T is supported by both peers, it is used
                     75:        #         regardless of whether there is a NAT gateway between them
                     76:        #         or not. This is useful for traversing some firewalls.
                     77:        nat_traversal on;
                     78:        
                     79:        proposal {
                     80:                authentication_method rsasig;
                     81:                encryption_algorithm 3des;
                     82:                hash_algorithm sha1;
                     83:                dh_group 2;
                     84:        }
                     85: 
                     86:        proposal_check strict;
                     87: }
                     88: 
                     89: # Phase 2 proposal (for IPsec SA)
                     90: sainfo anonymous
                     91: {
                     92:        pfs_group 2;
                     93:        lifetime time 12 hour;
                     94:        encryption_algorithm 3des, rijndael;
                     95:        authentication_algorithm hmac_sha1;
                     96:        compression_algorithm deflate;
                     97: }