racoon.conf.in revision 1.1 
1# $KAME: racoon.conf.in,v 1.18 2001/08/16 06:33:40 itojun Exp $
2
3# "path" must be placed before it should be used.
4# You can overwrite which you defined, but it should not use due to confusing.
5path include "@sysconfdir_x@/racoon";
6#include "remote.conf";
7
8# search this file for pre_shared_key with various ID key.
9path pre_shared_key "@sysconfdir_x@/racoon/psk.txt";
10
11# racoon will look for certificate file in the directory,
12# if the certificate/certificate request payload is received.
13path certificate "@sysconfdir_x@/cert";
14
15# "log" specifies logging level.  It is followed by either "notify", "debug"
16# or "debug2".
17#log debug;
18
19# "padding" defines some parameter of padding.  You should not touch these.
20padding
21{
22	maximum_length 20;	# maximum padding length.
23	randomize off;		# enable randomize length.
24	strict_check off;	# enable strict check.
25	exclusive_tail off;	# extract last one octet.
26}
27
28# if no listen directive is specified, racoon will listen to all
29# available interface addresses.
30listen
31{
32	#isakmp ::1 [7000];
33	#isakmp 202.249.11.124 [500];
34	#admin [7002];		# administrative's port by kmpstat.
35	#strict_address; 	# required all addresses must be bound.
36}
37
38# Specification of default various timer.
39timer
40{
41	# These value can be changed per remote node.
42	counter 5;		# maximum trying count to send.
43	interval 20 sec;	# maximum interval to resend.
44	persend 1;		# the number of packets per a send.
45
46	# timer for waiting to complete each phase.
47	phase1 30 sec;
48	phase2 15 sec;
49}
50
51remote anonymous
52{
53	exchange_mode main,aggressive;
54	doi ipsec_doi;
55	situation identity_only;
56
57	my_identifier asn1dn;
58	certificate_type x509 "my.cert.pem" "my.key.pem";
59
60	nonce_size 16;
61	initial_contact on;
62	proposal_check obey;	# obey, strict or claim
63
64	proposal {
65		encryption_algorithm 3des;
66		hash_algorithm sha1;
67		authentication_method rsasig;
68		dh_group 2;
69	}
70}
71
72remote ::1 [8000]
73{
74	#exchange_mode main,aggressive;
75	exchange_mode aggressive,main;
76	doi ipsec_doi;
77	situation identity_only;
78
79	my_identifier user_fqdn "sakane@kame.net";
80	peers_identifier user_fqdn "sakane@kame.net";
81	#certificate_type x509 "mycert" "mypriv";
82
83	nonce_size 16;
84	lifetime time 1 min;	# sec,min,hour
85
86	proposal {
87		encryption_algorithm 3des;
88		hash_algorithm sha1;
89		authentication_method pre_shared_key;
90		dh_group 2;
91	}
92}
93
94sainfo anonymous
95{
96	pfs_group 2;
97	encryption_algorithm 3des;
98	authentication_algorithm hmac_sha1;
99	compression_algorithm deflate;
100}
101
102sainfo address 203.178.141.209 any address 203.178.141.218 any
103{
104	pfs_group 2;
105	lifetime time 30 sec;
106	encryption_algorithm des;
107	authentication_algorithm hmac_md5;
108	compression_algorithm deflate;
109}
110
111sainfo address ::1 icmp6 address ::1 icmp6
112{
113	pfs_group 3;
114	lifetime time 60 sec;
115	encryption_algorithm 3des, blowfish, aes;
116	authentication_algorithm hmac_sha1, hmac_md5;
117	compression_algorithm deflate;
118}
119
120