summaryrefslogtreecommitdiff
path: root/sbin/isakmpd/isakmpd.conf.5
AgeCommit message (Collapse)Author
2008-02-17Define default configurations for AES-192 and AES-256. From Mitja MuzenicHans-Joerg Hoexer
<mitja at muzenic dot net>, diff provided already quite some time ago, many many thanks. This should have gone in months ago but I was slacking, sorry for that.
2007-05-31convert to new .Dd format;Jason McIntyre
2007-05-23Get rid of some obsolete exampels.Hans-Joerg Hoexer
ok and prodding @jmc
2007-03-18Fix usage of predefined lifetimes. "Default-phase-[12]-lifetime"Hans-Joerg Hoexer
just specifies the values to be used. However, the specifications are called "LIFE_MAIN_MODE" and "LIFE_QUICK_MODE". ok ho@ jmc@
2007-02-19tweak;Jason McIntyre
2007-02-19Document NULL encryption.Hans-Joerg Hoexer
2006-11-24add support to tag ipsec traffic belonging to specific IKE-initiatedReyk Floeter
phase 2 traffic. this allows policy-based filtering of encrypted and unencrypted ipsec traffic with pf(4). see ipsec.conf(5) and isakmpd.conf(5) for details and examples. this is work in progress and still needs some testing and feedback, but it is safe to put it in now. ok hshoexer@
2006-09-15Remove "Delete-SAs" config option. This was needed for interactionHans-Joerg Hoexer
with sasyncd(8). Now sasyncd(8) controls isakmpd(8) regarding SA deletion so this option is obsolete. ok mpf jmc
2006-08-30Make SA deletion on shutdown the default again. Use -S for failoverHans-Joerg Hoexer
situations where you do not want this. Discussed and agreed on with ho, mcbride, markus, cloder,... We will have to teach sasyncd to deal with this. Testing by msf and hshoexer with help from mtu ok markus cloder
2006-06-11Document AESCTR for quick mode and SHA2-* for main mode. Help by jmc.Hans-Joerg Hoexer
ok jmc@
2006-06-11tweaks;Jason McIntyre
2006-06-10Document -S and the "Delete-SAs" tag. Those will enable SA deletionHans-Joerg Hoexer
on shutdown.
2006-06-10Allow isakmpd to use a different private rsa key per isakmp ID. Hans wrote ↵Mathieu Sauve-Frankel
this a long time ago, I synced it to -current and tested. ok hshoexer@
2006-05-27document modp3072.Hans-Joerg Hoexer
2006-05-26ipsectl -> ipsecctlJason McIntyre
2006-05-26vpn.8 removal;Jason McIntyre
2006-05-26let us not talk about ipsecadm and vpn anymore; ok reykTheo de Raadt
2005-10-06improve examples and show how to use KEY_LENGTH. Slightly different fix thanHans-Joerg Hoexer
proposed by sthen at spacehopper dot org, fixes pr 4522, thanks! ok and with jmc@
2005-08-23`DSS' is unsupported, so remove references to it;Jason McIntyre
ok hshoexer@
2005-06-11grammar;Jason McIntyre
2005-05-31certpatch is gone, noticed by david@Hans-Joerg Hoexer
2005-05-23Mention interface names can be used in Listen-on. OK hshoexerChad Loder
2005-05-12add some missing section descriptions to make this page a littleJason McIntyre
easier to read; ok hshoexer@
2005-05-05alphabetically order options within sections;Jason McIntyre
discussed w/ hshoexer@
2005-05-05this is not a separate list item;Jason McIntyre
ok hshoexer@
2005-05-05first stab at making this page easier to read:Jason McIntyre
various grammar/mdoc fixes;
2005-04-06Check-interval and DPD-check-interval are specified in seconds.Chad Loder
2005-02-22fix wrong line break in comment.Moritz Jodeit
ok hshoexer@
2005-01-05kill whitespace;Jason McIntyre
2005-01-05Discourage using aggressive mode.Hans-Joerg Hoexer
ok and some help ho@
2004-12-14Allow the Address, Network, or Netmask values of the <IPsec-ID> to beRyan Thomas McBride
specified with an interface name (in which case the first address is used) or the keyword 'default' (in which case the address is selected based on the default route). eg: [roadwarrior-ip] ID-type= IPV4_ADDR Address= default ok ho@ hshoexer@
2004-08-10Better implementation of the Dead Peer Detection protocol, RFC 3706.Hakan Olsson
hshoexer@ ok.
2004-07-08typo, and line adjustment;Jason McIntyre
2004-07-07document -a/-K and "Acquire-Only"/"Use-Keynote".Hans-Joerg Hoexer
ok markus@ henning@ ho@ english polish and mdoc help and ok jmc@
2004-06-26new sentence, new line;Jason McIntyre
2004-06-21Describe the [Default]:NAT-T-Keepalive configuration parameter.Hakan Olsson
2004-02-27Add group 14 (modp2048) to predefined suites. Manpage also updated.Hans-Joerg Hoexer
ok ho@
2004-02-26tweak;Jason McIntyre
ok hshoexer@
2004-02-25Add and document configuration options Logverbose and Loglevel. As log.c nowHans-Joerg Hoexer
depends on conf.c and some regression tests use log.c, add conf.c to Makefiles where necessary. ok ho@
2003-11-05PFS: Perfect Forward Secrecy (RFC 2409);Jason McIntyre
from misc@ and ok markus@
2003-08-28support AES in phase 1, too. switch to OpenSSL EVP interface;Markus Friedl
with Hans-Joerg.Hoexer at yerbouti.franken.de; ok ho@
2003-08-09new sentence, new line + small cleanup;Jason McIntyre
ok ho@
2003-07-25add sha2 support; ok ho@Markus Friedl
2003-07-09- remove some .Ss's that worked around the old blank line bugJason McIntyre
- remove some unnecessary .Pp's - mdoc a list ok ho@
2003-06-03Remove clauses 3 and 4. With approval from Niklas Hallqvist andHakan Olsson
Niels Provos.
2003-06-03- section reorderJason McIntyre
- some mdoc fixes
2003-05-17tweak;Jason McIntyre
ok ho@
2003-05-16If the "Renegotiate-on-HUP" tag is defined in the [General] section, aHakan Olsson
HUP signal (or "R" to the FIFO) will also renegotiate all Phase 2 SAs, i.e all connections. ok niklas@, tested and ok kjell@.
2003-05-10typos;Jason McIntyre
2003-03-21document [initiator-id] section; richb@timestone.com.au; ok ho@, jmc@Markus Friedl
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-03 07:03:20 +0000