blob: b64c80110e18c7601e36de47c50a0efd0b95bd1d (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
|
# $OpenBSD: VPN-3way-template.conf,v 1.11 2004/02/11 08:55:22 jmc Exp $
# $EOM: VPN-3way-template.conf,v 1.8 2000/10/09 22:08:30 angelos Exp $
#
# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE) daemon.
#
# This is a template file of a VPN setup between three nodes in
# a fully meshed 'three-way' configuration. Suggested use is to copy
# this file to all three nodes and then edit them accordingly.
#
# These nodes are initially called XXX, YYY and ZZZ.
#
# In pseudographics: XXX --- YYY
# \ /
# ZZZ
#
# In cases where IP/network addresses should be defined values like
# 192.168.XXX.nnn have been used.
#
# Incoming phase 1 negotiations are multiplexed on the source IP
# address. In the three-way VPN, we have two possible peers.
[Phase 1]
192.168.YYY.nnn= ISAKMP-peer-node-YYY
192.168.ZZZ.nnn= ISAKMP-peer-node-ZZZ
# These connections are walked over after config file parsing and
# told to the application layer so that it will inform us when
# traffic wants to pass over them. This means we can do on-demand
# keying. In the three-way VPN, each node knows two connections.
[Phase 2]
Connections= IPsec-Conn-XXX-YYY,IPsec-Conn-XXX-ZZZ
# ISAKMP Phase 1 peer sections
##############################
[ISAKMP-peer-node-YYY]
Phase= 1
Transport= udp
Address= 192.168.YYY.nnn
Configuration= Default-main-mode
Authentication= yoursharedsecretwithYYY
[ISAKMP-peer-node-ZZZ]
Phase= 1
Transport= udp
Address= 192.168.ZZZ.nnn
Configuration= Default-main-mode
Authentication= yoursharedsecretwithZZZ
# IPsec Phase 2 sections
########################
[IPsec-Conn-XXX-YYY]
Phase= 2
ISAKMP-peer= ISAKMP-peer-node-YYY
Configuration= Default-quick-mode
Local-ID= MyNet-XXX
Remote-ID= OtherNet-YYY
[IPsec-Conn-XXX-ZZZ]
Phase= 2
ISAKMP-peer= ISAKMP-peer-node-ZZZ
Configuration= Default-quick-mode
Local-ID= MyNet-XXX
Remote-ID= OtherNet-ZZZ
# Client ID sections
####################
[MyNet-XXX]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.XXX.0
Netmask= 255.255.255.0
[OtherNet-YYY]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.YYY.0
Netmask= 255.255.255.0
[OtherNet-ZZZ]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.ZZZ.0
Netmask= 255.255.255.0
#
# There is no more node-specific configuration below this point.
#
# Main mode descriptions
[Default-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
Transforms= 3DES-SHA,3DES-MD5
[Blowfish-main-mode]
DOI= IPSEC
EXCHANGE_TYPE= ID_PROT
Transforms= BLF-SHA-M1024
# Quick mode description
########################
[Default-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
Suites= QM-ESP-AES-SHA-PFS-SUITE
[Blowfish-quick-mode]
DOI= IPSEC
EXCHANGE_TYPE= QUICK_MODE
Suites= QM-ESP-BLF-SHA-PFS-SUITE
#Suites= QM-ESP-BLF-SHA-SUITE
|
