path: root/share/man/man8/vpn.8

.\" $OpenBSD: vpn.8,v 1.47 2000/11/20 08:00:04 deraadt Exp $
.\" Copyright 1998 Niels Provos <provos@physnet.uni-hamburg.de>
.\" All rights reserved.
.\"
.\" Redistribution and use in source and binary forms, with or without
.\" modification, are permitted provided that the following conditions
.\" are met:
.\" 1. Redistributions of source code must retain the above copyright
.\"    notice, this list of conditions and the following disclaimer.
.\" 2. Redistributions in binary form must reproduce the above copyright
.\"    notice, this list of conditions and the following disclaimer in the
.\"    documentation and/or other materials provided with the distribution.
.\" 3. All advertising materials mentioning features or use of this software
.\"    must display the following acknowledgement:
.\"      This product includes software developed by Niels Provos.
.\" 4. The name of the author may not be used to endorse or promote products
.\"    derived from this software without specific prior written permission.
.\"
.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
.\" Manual page, using -mandoc macros
.\"
.Dd February 9, 1999
.Dt VPN 8
.Os
.Sh NAME
.Nm vpn
.Nd configuring the system for virtual private networks
.Sh DESCRIPTION
A virtual private network is used to securely connect two or more subnets
over the internet. For each subnet there is a security gateway which is
linked via a cryptographically secured tunnel to the security gateway of
the other subnet.
.Xr ipsec 4
is used to provide the necessary network-layer cryptographic services.
This document describes the configuration process for setting up a
.Nm VPN .
.Pp
Briefly, creating a VPN consists of the following steps:
.Pp
.Bl -enum -compact
.It
Choose a key exchange method: manual keyed, or automated via
.Xr isakmpd 8
or
.Xr photurisd 8 .
.It
For manual keying, create the Security Associations (SA), one for
each endpoint.
.It
For manual keying, create the appropriate IPsec flows.
.It
For automated keying, create a configuration file for the keying
daemon.
.It
Configure your firewall rules appropriately.
.El
.Ss Choosing a key exchange method
There are currently three key exchange methods available:
.Pp
.Bl -bullet -inset -compact
.It
manual (symmetric shared secret)
.It
.Xr isakmpd 8
.It
.Xr photurisd 8
.El
.Pp
At present,
.Xr photurisd 8
has a limitation in that the IP adress of the security gateway must
fall within the range of adresses being tunnelled to, making VPNs
between (non-routable) private (RFC 1918) networks difficult.
This does not apply to
.Xr isakmpd 8 .
.Ss Enabling the Appropriate Kernel Operations
Make sure that the following options and devices are enabled in the kernel:
.Bd -literal
option    CRYPTO          # Cryptographic Framework
option    IPSEC           # IPSEC VPN
#option   KEY             # KEY implied by IPSEC
pseudo-device enc 4       # Encapsulation device used by IPSEC
.Ed
.Pp
.Xr ipsec 4
operations must be first enabled using
.Xr sysctl 8 .
Before doing either manual or automated keying, or performing
encryption (ESP) or authentication (AH) operations, ensure the appropriate
kernel operation has been enabled:
.Bd -literal
	# sysctl -w net.inet.esp.enable=1
	# sysctl -w net.inet.ah.enable=1
.Ed
.Pp
For security gateways, enabling packet forwarding is often
required:
.Bd -literal
	# sysctl -w net.inet.ip.forwarding=1
.Ed
.Pp
For more permanent operation, these options should be enabled in your
.Xr sysctl.conf 5 .
.Pp

.Ss Generating Manual Keys [manual keying]
The shared secret symmetric keys used to create a VPN can
be any hexadecimal value, so long as both sides of the connection use
the same values. Since the security of the VPN is based on these keys
being unguessable, it is very important that the keys be chosen using a
strong random source. One practical method of generating them
is by using the
.Xr random 4
device. To produce 160 bits (20 bytes) of randomness, for example, do:
.Bd -literal
	# openssl rand 20 | hexdump -e '20/1 "%02x"'
.Ed
.Pp
or:
.Bd -literal
	# openssl rand 20 | perl -pe 's/./unpack("H2",$&)/ges'
.Ed
.Pp
Different cipher types may require different sized keys.
.Pp
.Bl -column "Cipher" "Key Length" -compact
.It Em Cipher	Key Length
.It Li DES Ta "56 bits"
.It Li 3DES Ta "168 bits"
.It Li BLF Ta "Variable (160 bits recommended)"
.It Li CAST Ta "Variable (128 bits maximum and recommended)"
.It Li SKIPJACK Ta "80 bits"
.El
.Pp
Use of DES or SKIPJACK as an encryption algorithm is not recommended
(except for backwards compatibility) due to their short key length.
Furthermore, recent attacks on SKIPJACK have shown severe weaknesses
in its structure.
.Pp
Note that DES requires 8 bytes to form a 56-bit key and 3DES requires 24 bytes
to form its 168-bit key. This is because the most significant bit of each byte
is ignored by both algorithms.
.Ss Creating Security Associations [manual keying]
Before the IPsec flows can be defined, two Security Associations (SAs)
must be defined on each end of the VPN, e.g.:
.Bd -literal
	# ipsecadm new esp -spi SPI_AB -src A_EXTERNAL_IP \e
	    -dst B_EXTERNAL_IP -forcetunnel -enc 3des -auth sha1 \e
	    -keyfile ENCRYPTION_KEY_FILE \e
	    -authkeyfile AUTHENTICATION_KEY_FILE
	# ipsecadm new esp -spi SPI_BA -src B_EXTERNAL_IP \e
	    -dst A_EXTERNAL_IP -forcetunnel -enc 3des -auth sha1 \e
	    -keyfile ENCRYPTION_KEY_FILE \e
	    -authkeyfile AUTHENTICATION_KEY_FILE
.Ed
.Pp
Note that the
.Fl key
and
.Fl authkey
options may be used to specify the keys directly in the
.Xr ipsecadm 8
command line.  However, another user could view the keys by using the
.Xr ps 1
command at the appropriate time (or use a program for doing so).
.Pp
.Ss Creating IPsec Flows [manual keying]
Both IPsec gateways need to configure
.Xr ipsec 4
routes with the
.Xr ipsecadm 8
tool:
.Pp
On the security gateway of subnet A:
.Bd -literal
	# ipsecadm flow -dst B_EXTERNAL_IP -proto esp
	    -addr A_EXTERNAL_IP 255.255.255.255
	          B_EXTERNAL_IP 255.255.255.255
	    -require -out -src A_EXTERNAL_IP
	# ipsecadm flow -dst B_EXTERNAL_IP -proto esp
	    -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	          B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	    -require -out -src A_EXTERNAL_IP
	# ipsecadm flow -dst B_EXTERNAL_IP -proto esp
	    -addr A_EXTERNAL_IP 255.255.255.255
	          B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	    -require -out -src A_EXTERNAL_IP
	# ipsecadm flow -dst B_EXTERNAL_IP -proto esp
	    -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	          B_EXTERNAL_IP 255.255.255.255
	    -require -out -src A_EXTERNAL_IP
	
	# ipsecadm flow -dst B_EXTERNAL_IP -proto esp
	    -addr B_EXTERNAL_IP 255.255.255.255
	          A_EXTERNAL_IP 255.255.255.255 
	    -require -in -src A_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	          A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	    -require -in -src A_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_EXTERNAL_IP 255.255.255.255
	          A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	    -require -in -src A_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	          A_EXTERNAL_IP 255.255.255.255
	    -require -in -src A_EXTERNAL_IP
.Ed
.Pp
and on the security gateway of subnet B:
.Bd -literal
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_EXTERNAL_IP 255.255.255.255
	          A_EXTERNAL_IP 255.255.255.255
	    -out -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	          A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	    -out -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_EXTERNAL_IP 255.255.255.255
	          A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	    -out -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	          A_EXTERNAL_IP 255.255.255.255
	    -out -require -src B_EXTERNAL_IP
	
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr A_EXTERNAL_IP 255.255.255.255
	          B_EXTERNAL_IP 255.255.255.255
	    -in -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	          B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	    -in -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr A_EXTERNAL_IP 255.255.255.255
	          B_INTERNAL_NETWORK B_INTERNAL_NETMASK
	    -in -require -src B_EXTERNAL_IP
	# ipsecadm flow -dst A_EXTERNAL_IP -proto esp
	    -addr A_INTERNAL_NETWORK A_INTERNAL_NETMASK
	          B_EXTERNAL_IP 255.255.255.255
	    -in -require -src B_EXTERNAL_IP
.Ed
.Pp
.Ss Configure and run the keying daemon [automated keying]
Unless manual keying is used, both security gateways need to start
either the
.Xr isakmpd 8
or
.Xr photurisd 8
key management daemon. To make sure the daemon is properly configured
to provide the required security services (typically, encryption and
authentication) start the daemon with debugging or verbose output.
.Pp
.Xr isakmpd 8
implements security policy using the
.Em KeyNote
trust management system.
.Ss Configuring Firewall Rules
.Xr ipf 8
needs to be configured such that all packets from the outside are blocked
by default.
Only successfully IPsec-processed packets (from the
.Xr enc 4
interface), or key management packets (for
.Xr photurisd 8 ,
.Tn UDP
packets with source and destination ports of 468, and for
.Xr isakmpd 8 ,
.Tn UDP
packets with source and destination ports of 500) should be allowed to pass.
.Pp
The
.Xr ipf 5
rules for a tunnel which uses encryption (the ESP IPsec protocol) and
.Xr photurisd 8
on security gateway A might look like this:
.Bd -literal
# ne0 is the only interface going to the outside.
block in log on ne0 from any to any
block out log on ne0 from any to any
block in log on enc0 from any to any
block out log on enc0 from any to any

# Passing in encrypted traffic from security gateways
pass in proto esp from gatewB/32 to gatewA/32
pass out proto esp from gatewA/32 to gatewB/32

# Passing in traffic from the designated subnets.
pass in on enc0 from netB/netBmask to netA/netAmask
pass out on enc0 from natA/netAmask to netB/netBmask

# Passing in Photuris traffic from the security gateways
pass in on ne0 proto udp from gatewB/32 port = 468 to gatewA/32 port = 468
pass out on ne0 proto udp from gatewA/32 port = 468 to gatewB/32 port = 468
.Ed
.Pp
If there are no other
.Xr ipf 5
rules, the "quick" clause can be added to the last four rules.
NAT rules can also be used on the
.Xr enc 4
interface.
Note that it is strongly encouraged that instead of detailed IPF
rules, the SPD (IPsec flow database) be utilized to specify security
policy, if only to avoid filtering conflicts.
.Sh EXAMPLES
.Ss Manual keying
To create a manual keyed VPN between two class C networks using
3DES encryption and the following IP addresses:
.Pp
.Bd -literal
 A_INTERNAL_IP = 10.0.50.1
 A_EXTERNAL_IP = 192.168.1.254
 B_EXTERNAL_IP = 192.168.2.1
 B_INTERNAL_IP = 10.0.99.1
.Ed
.Pp
.Bl -enum
.It
Choose the shared secrets using a suitably random method.
The 3DES encryption key needs 192 bits (3x64), or 24 bytes.
The SHA-1 authentication key for needs 160 bits, or 20 bytes.
.Pp
.Bd -literal
# openssl rand 24 | hexdump -e '24/1 "%02x"' > enc_key

# openssl rand 20 | hexdump -e '20/1 "%02x"' > auth_key
.Ed
.Pp
.It
Create the Security Associations (on both endpoints):
.Pp
.Bd -literal
# /sbin/ipsecadm new esp -src 192.168.2.1 -dst 192.168.1.254 \e\ 
   -forcetunnel -spi 1000 -enc 3des -auth sha1 \e\ 
   -keyfile enc_key -authkeyfile auth_key

# /sbin/ipsecadm new esp -src 192.168.1.254 -dst 192.168.2.1  \e\ 
   -forcetunnel -spi 1001 -enc 3des -auth sha1 \e\ 
   -keyfile enc_key -authkeyfile auth_key
.Ed
.Pp
.It
Create the IPsec flows on machine A (the first four are the
outbound flows, the latter four are the ingress filters for the
incoming security association):
.Pp
.Bd -literal
# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 192.168.1.254 255.255.255.255 \e\ 
          192.168.2.1 255.255.255.255 -out \e\ 
    -require -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 10.0.50.0 255.255.255.0 10.0.99.0 255.255.255.0 \e\ 
    -require -out -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 192.168.1.254 255.255.255.255 \e\ 
          10.0.99.0 255.255.255.0  \e\ 
    -require -out -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 10.0.50.0 255.255.255.0 192.168.2.1 255.255.255.255 \e\ 
    -require -out -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 192.168.2.1 255.255.255.255 \e\ 
          192.168.1.254 255.255.255.255  \e\ 
    -require -in -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 10.0.99.0 255.255.255.0 10.0.50.0 255.255.255.0 \e\ 
    -require -in -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 192.168.2.1 255.255.255.255 \e\ 
           10.0.50.0 255.255.255.0  \e\ 
    -require -in -src 192.168.1.254

# /sbin/ipsecadm flow -dst 192.168.2.1 -proto esp \e\ 
    -addr 10.0.99.0 255.255.255.0 \e\ 
	   192.168.1.254 255.255.255.255  \e\ 
    -require -in -src 192.168.1.254
.Ed
.It
Create the ipsec flows on machine B:
.Bd -literal
# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 192.168.2.1 255.255.255.255 \e\ 
          192.168.1.254 255.255.255.255 \e\ 
    -require -out -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 10.0.99.0 255.255.255.0 10.0.50.0 255.255.255.0 \e\ 
    -require -out -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 192.168.2.1 255.255.255.255 \e\ 
           10.0.50.0 255.255.255.0 -require -out -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 10.0.99.0 255.255.255.0 192.168.1.254 255.255.255.255 \e\ 
    -require -out -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 192.168.1.254 255.255.255.255 \e\ 
          192.168.2.1 255.255.255.255 -require -in -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 10.0.50.0 255.255.255.0 10.0.99.0 255.255.255.0 \e\ 
    -require -in -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 192.168.1.254 255.255.255.255 \e\ 
          10.0.99.0 255.255.255.0 -require -in -src 192.168.2.1

# /sbin/ipsecadm flow -dst 192.168.1.254 -proto esp \e\ 
    -addr 10.0.50.0 255.255.255.0 192.168.2.1 255.255.255.255 \e\ 
    -require -in -src 192.168.2.1
.Ed
.It
Configure the firewall rules on machine A:
.Bd -literal
# ne0 is the only interface going to the outside.
block in log on ne0 from any to any
block out log on ne0 from any to any
block in log on enc0 from any to any
block out log on enc0 from any to any

# Passing in encrypted traffic from security gateways
pass in proto esp from 192.168.2.1/32 to 192.168.1.254/32
pass out proto esp from 192.168.1.254/32 to 192.168.2.1/32

# Passing in traffic from the designated subnets.
pass in quick on enc0 from 10.0.99.0/24 to 10.0.50.0/24
pass out quick on enc0 from 10.0.50.0/24 to 10.0.99.0/24 
.Ed
.It
Configure the firewall rules on machine B:
.Bd -literal
# ne0 is the only interface going to the outside.
block in log on ne0 from any to any
block out log on ne0 from any to any
block in log on enc0 from any to any
block out log on enc0 from any to any

# Passing in encrypted traffic from security gateways
pass in proto esp from 192.168.1.254/32 to 192.168.2.1/32
pass out proto esp from 192.168.2.1/32 to 192.168.1.254/32

# Passing in traffic from the designated subnets.
pass in quick on enc0 from 10.0.50.0/24 to 10.0.99.0/24
pass out quick on enc0 from 10.0.99.0/24 to 10.0.50.0/24
.Ed
.El
.Ss Automated keying
To create a VPN between the same two C class networks as the example
above, using
.Xr isakmpd 8 :
.Pp
.Bl -enum
.It
Create
.Pa /etc/isakmpd/isakmpd.conf
for machine A:
.Pp
.Bd -literal

# Incoming phase 1 negotiations are multiplexed on the source IP
# address. Phase 1 is used to setup a protected channel just
# between the two gateway machines. This channel is then used for
# the phase 2 negotiation traffic (i.e encrypted & authenticated).

[Phase 1]
193.168.2.1=		peer-machineB

# 'Phase 2' defines which connections the daemon should establish.
# These connections contain the actual "IPsec VPN" information.

[Phase 2]
Connections=		VPN-A-B

# ISAKMP phase 1 peers (from [Phase 1])

[peer-machineB]
Phase=			1
Transport=		udp
Address=		192.168.1.254
Configuration=		Default-main-mode
Authentication=		yoursharedsecret

# IPSEC phase 2 connections (from [Phase 2])

[VPN-A-B]
Phase=			2
ISAKMP-peer=		peer-machineB
Configuration=		Default-quick-mode
Local-ID=		machineA-internal-network
Remote-ID=		machineB-internal-network

# ID sections (as used in [VPN-A-B])

[machineA-internal-network]
ID-type=		IPV4_ADDR_SUBNET
Network=		10.0.50.0
Netmask=		255.255.255.0

[machineB-internal-network]
ID-type=		IPV4_ADDR_SUBNET
Network=		10.0.99.0
Netmask=		255.255.255.0

# Main and Quick Mode descriptions (as used by peers and connections)

[Default-main-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		ID_PROT
Transforms=		3DES-SHA,BLF-SHA

[Default-quick-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		QUICK_MODE
Suites=			QM-ESP-3DES-SHA-SUITE
.Ed
.Pp
.It
Create
.Pa /etc/isakmpd/isakmpd.conf
for machine B:
.Bd -literal

# Incoming phase 1 negotiations are multiplexed on the source IP
# address. Phase 1 is used to setup a protected channel just
# between the two gateway machines. This channel is then used for
# the phase 2 negotiation traffic (i.e encrypted & authenticated).

[Phase 1]
193.168.1.254=		peer-machineA

# 'Phase 2' defines which connections the daemon should establish.
# These connections contain the actual "IPsec VPN" information.

[Phase 2]
Connections=		VPN-B-A

# ISAKMP phase 1 peers (from [Phase 1])

[peer-machineA]
Phase=			1
Transport=		udp
Address=		192.168.2.1
Configuration=		Default-main-mode
Authentication=		yoursharedsecret

# IPSEC phase 2 connections (from [Phase 2])

[VPN-B-A]
Phase=			2
ISAKMP-peer=		peer-machineA
Configuration=		Default-quick-mode
Local-ID=		machineB-internal-network
Remote-ID=		machineA-internal-network

# ID sections (as used in [VPN-A-B])

[machineA-internal-network]
ID-type=		IPV4_ADDR_SUBNET
Network=		10.0.50.0
Netmask=		255.255.255.0

[machineB-internal-network]
ID-type=		IPV4_ADDR_SUBNET
Network=		10.0.99.0
Netmask=		255.255.255.0

# Main and Quick Mode descriptions (as used by peers and connections)

[Default-main-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		ID_PROT
Transforms=		3DES-SHA,BLF-SHA

[Default-quick-mode]
DOI=			IPSEC
EXCHANGE_TYPE=		QUICK_MODE
Suites=			QM-ESP-3DES-SHA-SUITE
.Ed
.Pp
.It
Read through the configuration one more time. The only real
differences between the two files in this example is
the IP-addresses, and ordering of Local- and Remote-ID for the VPN
itself. Note that the shared secret (the
.Em Authentication
tag) must match between machineA and machineB.
.Pp
Do to the shared secret information in the configuration file, it must
be installed without any permissions for "group" or "other".
.Bd -literal
# chmod og-rwx /etc/isakmpd/isakmpd.conf
.Ed
.Pp
.It
Create a simple
.Pa /etc/isakmpd/isakmpd.policy
file for machineA:
.Pp
.Bd -literal
Keynote-version: 2
Authorizer: "POLICY"
Conditions: app_domain == "IPsec policy" &&
            esp_present == "yes" &&
            esp_enc_alg != "null" -> "true";
.Ed
.Pp
.It
Create a simple
.Pa /etc/isakmpd/isakmpd.policy
file for machineB:
.Pp
.Bd -literal
Keynote-version: 2
Authorizer: "POLICY"
Conditions: app_domain == "IPsec policy" &&
            esp_present == "yes" &&
            esp_enc_alg != "null" -> "true";
.Ed
.Pp
.It
Configure the firewall rules on machines A and B:
.Pp
Use the same ruleset as the manual keying example, but add permission
for the
.Xr isakmpd 8
control traffic, on
.Tn UDP
port 500.
.Pp
For machineA, add:
.Bd -literal
# Permit ISAKMPD control traffic between A and B
pass in proto udp from 192.168.2.1/32 to 193.127.1.254/32 port = 500
pass out proto udp from 192.168.1.254/32 to 193.127.2.1/32 port = 500
.Ed
.Pp
For machineB, add:
.Bd -literal
# Permit ISAKMPD control traffic between A and B
pass in proto udp from 192.168.1.254/32 to 193.127.2.1/32 port = 500
pass out proto udp from 192.168.2.1/32 to 193.127.1.254/32 port = 500
.Ed
.Pp
.It
Start
.Xr isakmpd 8
.Pp
On both machines, run:
.Bd -literal
# /sbin/isakmpd
.Ed
.Pp
For run with verbose debugging enabled, instead start with:
.Bd -literal
# /sbin/isakmpd -d -DA=99
.Ed
.El
.Sh FILES
.Bl -tag -width /etc/photuris/photuris.conf -compact
.It Pa /usr/share/ipsec/rc.vpn
Sample VPN configuration file
.It Pa /etc/isakmpd/isakmpd.conf
.Xr isakmpd 8
configuration file
.It Pa /etc/photuris/photuris.conf
Photuris configuration file
.It Pa /etc/ipf.rules
Firewall configuration file
.El
.Sh BUGS
.Xr photurisd 8
can not be used in VPN mode unless both of the security gateway IP addresses
lie within the network ranges being tunnelled to.
In situations where the gateway IP is outside the desired netrange, such
as with private (RFC 1918) networks,
.Xr isakmpd 8
or manual keying must be used.
.Sh SEE ALSO
.Xr enc 4 ,
.Xr ipsec 4 ,
.Xr options 4 ,
.Xr ipf 5 ,
.Xr ipf 8 ,
.Xr ipsecadm 8 ,
.Xr sysctl 8 ,
.Xr openssl 1 ,
.Xr isakmpd 8 ,
.Xr isakmpd.conf 5 ,
.Xr isakmpd.policy 5 ,
.Xr keynote 4 ,
.Xr photurisd 8