2 #ident "%Z%%M% %I% %E% SMI"
4 # Copyright 2005 Sun Microsystems, Inc. All rights reserved.
5 # Use is subject to license terms.
9 # The contents of this file are subject to the terms of the
10 # Common Development and Distribution License, Version 1.0 only
11 # (the "License"). You may not use this file except in compliance
14 # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
15 # or http://www.opensolaris.org/os/licensing.
16 # See the License for the specific language governing permissions
17 # and limitations under the License.
19 # When distributing Covered Code, include this CDDL HEADER in each
20 # file and include the License file at usr/src/OPENSOLARIS.LICENSE.
21 # If applicable, add the following below this CDDL HEADER, with the
22 # fields enclosed by brackets "[]" replaced with your own identifying
23 # information: Portions Copyright [yyyy] [name of copyright owner]
27 # This file should be copied to /etc/inet/ipsecinit.conf to enable IPsec
28 # systemwide policy (and as a side-effect, load IPsec kernel modules).
29 # Even if this file has no entries, IPsec will be loaded if
30 # /etc/inet/ipsecinit.conf exists.
32 # Add entries to protect the traffic using IPSEC. The entries in this
33 # file are currently configured using ipsecconf from inetinit script
34 # after /usr is mounted.
38 # {rport 23} ipsec {encr_algs des encr_auth_algs md5}
40 # Or, in the older (but still usable) syntax
42 # {dport 23} apply {encr_algs des encr_auth_algs md5 sa shared}
43 # {sport 23} permit {encr_algs des encr_auth_algs md5}
45 # will protect the telnet traffic originating from the host with ESP using
48 # {raddr 10.5.5.0/24} ipsec {auth_algs any}
50 # Or, in the older (but still usable) syntax
52 # {daddr 10.5.5.0/24} apply {auth_algs any sa shared}
53 # {saddr 10.5.5.0/24} permit {auth_algs any}
55 # will protect traffic to/from the 10.5.5.0 subnet with AH using any available
58 # To do basic filtering, a drop rule may be used. For example:
60 # {lport 23 dir in} drop {}
61 # {lport 23 dir out} drop {}
63 # will disallow any remote system from telnetting in.
65 # If you are using IPv6, it may be useful to bypass neighbor discovery
66 # to allow in.iked to work properly with on-link neighbors. To do that,
67 # add the following lines:
69 # {ulp ipv6-icmp type 133-137 dir both } pass { }
71 # This will allow neighbor discovery to work normally.
73 # WARNING: This file is read before default routes are established, and
74 # before any naming services have been started. The
75 # ipsecconf(1M) command attempts to resolve names, but it will
76 # fail unless the machine uses files, or DNS and the DNS server
77 # is reachable via routing information before ipsecconf(1m)
78 # invocation. (E.g. the DNS server is on-subnet, or DHCP
79 # has loaded up the default router already.)
81 # It is suggested that for this file, use hostnames only if
82 # they are in /etc/hosts, or use numeric IP addresses.
84 # If DNS gets used, the DNS server is implicitly trusted, which
85 # could lead to compromise of this machine if the DNS server
86 # has been compromised.