blob: 1af58b56683204304630b2757a5f55f409165fb5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
|
# $OpenBSD: VPN-3way-template.conf,v 1.12 2005/05/28 18:38:30 ho Exp $
#
# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKE) daemon.
#
# This is a template file of a VPN setup between three nodes in
# a fully meshed 'three-way' configuration. Suggested use is to copy
# this file to all three nodes and then edit them accordingly.
#
# These nodes are initially called XXX, YYY and ZZZ.
#
# In pseudographics: XXX --- YYY
# \ /
# ZZZ
#
# In cases where IP/network addresses should be defined values like
# 192.168.XXX.nnn have been used.
#
# Incoming phase 1 negotiations are multiplexed on the source IP
# address. In the three-way VPN, we have two possible peers.
[Phase 1]
192.168.YYY.nnn= ISAKMP-peer-node-YYY
192.168.ZZZ.nnn= ISAKMP-peer-node-ZZZ
# These connections are walked over after config file parsing and
# told to the application layer so that it will inform us when
# traffic wants to pass over them. This means we can do on-demand
# keying. In the three-way VPN, each node knows two connections.
[Phase 2]
Connections= IPsec-Conn-XXX-YYY,IPsec-Conn-XXX-ZZZ
# ISAKMP Phase 1 peer sections
[ISAKMP-peer-node-YYY]
Phase= 1
Address= 192.168.YYY.nnn
Configuration= Default-main-mode
Authentication= yoursharedsecretwithYYY
[ISAKMP-peer-node-ZZZ]
Phase= 1
Address= 192.168.ZZZ.nnn
Configuration= Default-main-mode
Authentication= yoursharedsecretwithZZZ
# IPsec Phase 2 sections
[IPsec-Conn-XXX-YYY]
Phase= 2
ISAKMP-peer= ISAKMP-peer-node-YYY
Configuration= Default-quick-mode
Local-ID= MyNet-XXX
Remote-ID= OtherNet-YYY
[IPsec-Conn-XXX-ZZZ]
Phase= 2
ISAKMP-peer= ISAKMP-peer-node-ZZZ
Configuration= Default-quick-mode
Local-ID= MyNet-XXX
Remote-ID= OtherNet-ZZZ
# Client ID sections
[MyNet-XXX]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.XXX.0
Netmask= 255.255.255.0
[OtherNet-YYY]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.YYY.0
Netmask= 255.255.255.0
[OtherNet-ZZZ]
ID-type= IPV4_ADDR_SUBNET
Network= 192.168.ZZZ.0
Netmask= 255.255.255.0
# Main mode description
[Default-main-mode]
EXCHANGE_TYPE= ID_PROT
Transforms= AES-SHA,3DES-SHA
# Quick mode description
[Default-quick-mode]
EXCHANGE_TYPE= QUICK_MODE
Suites= QM-ESP-AES-SHA-PFS-SUITE
|
