crypto/dist/ipsec-tools/src/racoon/samples/racoon.conf.in

   1 # $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
   2
   3 # "path" affects "include" directives.  "path" must be specified before any
   4 # "include" directive with relative file path.
   5 # you can overwrite "path" directive afterwards, however, doing so may add
   6 # more confusion.
   7 path include "@sysconfdir_x@/racoon";
   8 #include "remote.conf";
   9
  10 # the file should contain key ID/key pairs, for pre-shared key authentication.
  11 path pre_shared_key "@sysconfdir_x@/racoon/psk.txt";
  12
  13 # racoon will look for certificate file in the directory,
  14 # if the certificate/certificate request payload is received.
  15 path certificate "@sysconfdir_x@/cert";
  16
  17 # "log" specifies logging level.  It is followed by either "notify", "debug"
  18 # or "debug2".
  19 #log debug;
  20
  21 # "padding" defines some padding parameters.  You should not touch these.
  22 padding
  23 {
  24         maximum_length 20;      # maximum padding length.
  25         randomize off;          # enable randomize length.
  26         strict_check off;       # enable strict check.
  27         exclusive_tail off;     # extract last one octet.
  28 }
  29
  30 # if no listen directive is specified, racoon will listen on all
  31 # available interface addresses.
  32 listen
  33 {
  34         #isakmp ::1 [7000];
  35         #isakmp 202.249.11.124 [500];
  36         #admin [7002];          # administrative port for racoonctl.
  37         #strict_address;        # requires that all addresses must be bound.
  38 }
  39
  40 # Specify various default timers.
  41 timer
  42 {
  43         # These value can be changed per remote node.
  44         counter 5;              # maximum trying count to send.
  45         interval 20 sec;        # maximum interval to resend.
  46         persend 1;              # the number of packets per send.
  47
  48         # maximum time to wait for completing each phase.
  49         phase1 30 sec;
  50         phase2 15 sec;
  51 }
  52
  53 remote anonymous
  54 {
  55         exchange_mode main,aggressive;
  56         doi ipsec_doi;
  57         situation identity_only;
  58
  59         my_identifier asn1dn;
  60         certificate_type x509 "my.cert.pem" "my.key.pem";
  61
  62         nonce_size 16;
  63         initial_contact on;
  64         proposal_check strict;  # obey, strict, or claim
  65
  66         proposal {
  67                 encryption_algorithm 3des;
  68                 hash_algorithm sha1;
  69                 authentication_method rsasig;
  70                 dh_group 2;
  71         }
  72 }
  73
  74 remote ::1 [8000]
  75 {
  76         #exchange_mode main,aggressive;
  77         exchange_mode aggressive,main;
  78         doi ipsec_doi;
  79         situation identity_only;
  80
  81         my_identifier user_fqdn "sakane@kame.net";
  82         peers_identifier user_fqdn "sakane@kame.net";
  83         #certificate_type x509 "mycert" "mypriv";
  84
  85         nonce_size 16;
  86         lifetime time 1 min;    # sec,min,hour
  87
  88         proposal {
  89                 encryption_algorithm 3des;
  90                 hash_algorithm sha1;
  91                 authentication_method pre_shared_key;
  92                 dh_group 2;
  93         }
  94 }
  95
  96 sainfo anonymous
  97 {
  98         pfs_group 2;
  99         encryption_algorithm 3des;
 100         authentication_algorithm hmac_sha1;
 101         compression_algorithm deflate;
 102 }
 103
 104 sainfo address 203.178.141.209 any address 203.178.141.218 any
 105 {
 106         pfs_group 2;
 107         lifetime time 30 sec;
 108         encryption_algorithm des;
 109         authentication_algorithm hmac_md5;
 110         compression_algorithm deflate;
 111 }
 112
 113 sainfo address ::1 icmp6 address ::1 icmp6
 114 {
 115         pfs_group 3;
 116         lifetime time 60 sec;
 117         encryption_algorithm 3des, blowfish, aes;
 118         authentication_algorithm hmac_sha1, hmac_md5;
 119         compression_algorithm deflate;
 120 }
 121