#	$OpenBSD: VPN-3way-template.conf,v 1.12 2005/05/28 18:38:30 ho Exp $
#
# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE) daemon.
#
# This is a template file of a VPN setup between three nodes in
# a fully meshed 'three-way' configuration. Suggested use is to copy
# this file to all three nodes and then edit them accordingly.
#
# These nodes are initially called XXX, YYY and ZZZ.
#
# In pseudographics:   XXX --- YYY
#                         \   /
#                          ZZZ
#
# In cases where IP/network addresses should be defined values like
# 192.168.XXX.nnn have been used.
#

# Incoming phase 1 negotiations are multiplexed on the source IP
# address. In the three-way VPN, we have two possible peers.

[Phase 1]
192.168.YYY.nnn=	ISAKMP-peer-node-YYY
192.168.ZZZ.nnn=	ISAKMP-peer-node-ZZZ

# These connections are walked over after config file parsing and
# told to the application layer so that it will inform us when
# traffic wants to pass over them.  This means we can do on-demand
# keying. In the three-way VPN, each node knows two connections.

[Phase 2]
Connections=		IPsec-Conn-XXX-YYY,IPsec-Conn-XXX-ZZZ

# ISAKMP Phase 1 peer sections

[ISAKMP-peer-node-YYY]
Phase=			1
Address=		192.168.YYY.nnn
Configuration=		Default-main-mode
Authentication=		yoursharedsecretwithYYY

[ISAKMP-peer-node-ZZZ]
Phase=			1
Address=		192.168.ZZZ.nnn
Configuration=		Default-main-mode
Authentication=		yoursharedsecretwithZZZ

# IPsec Phase 2 sections

[IPsec-Conn-XXX-YYY]
Phase=			2
ISAKMP-peer=		ISAKMP-peer-node-YYY
Configuration=		Default-quick-mode
Local-ID=		MyNet-XXX
Remote-ID=		OtherNet-YYY

[IPsec-Conn-XXX-ZZZ]
Phase=			2
ISAKMP-peer=		ISAKMP-peer-node-ZZZ
Configuration=		Default-quick-mode
Local-ID=		MyNet-XXX
Remote-ID=		OtherNet-ZZZ

# Client ID sections

[MyNet-XXX]
ID-type=		IPV4_ADDR_SUBNET
Network=		192.168.XXX.0
Netmask=		255.255.255.0

[OtherNet-YYY]
ID-type=		IPV4_ADDR_SUBNET
Network=		192.168.YYY.0
Netmask=		255.255.255.0

[OtherNet-ZZZ]
ID-type=		IPV4_ADDR_SUBNET
Network=		192.168.ZZZ.0
Netmask=		255.255.255.0

# Main mode description

[Default-main-mode]
EXCHANGE_TYPE=		ID_PROT
Transforms=		AES-SHA,3DES-SHA

# Quick mode description

[Default-quick-mode]
EXCHANGE_TYPE=		QUICK_MODE
Suites=			QM-ESP-AES-SHA-PFS-SUITE