All pastes #412376 Raw Edit

Mine

public text v1 · immutable
#412376 ·published 2007-03-27 17:39 UTC
rendered paste body
ipsec client config file
path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

listen {
        adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
}

remote 10.0.0.1 {
        exchange_mode aggressive;
        ca_type x509 "root-ca.crt";
        proposal_check obey;
        nat_traversal on;
        ike_frag on;
        mode_cfg on;
        script "/etc/racoon/phase1-up.sh" phase1_up;
        script "/etc/racoon/phase1-down.sh" phase1_down;
        passive off;
        proposal {
                encryption_algorithm aes;
                hash_algorithm sha1;
                authentication_method hybrid_rsa_client;
                dh_group 2;
        }
}
 
 
sainfo anonymous {
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm aes;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate ;
}
 
ipsec server config file
path certificate "/etc/openssl/certs";


listen {

        adminsock disabled;

}

 

remote anonymous {

        exchange_mode aggressive;

        certificate_type x509 "my_certificate.pem" "my_private_key.pem";

        my_identifier asn1dn;

        proposal_check claim;

        generate_policy on;

        nat_traversal on;

        dpd_delay 20;

        ike_frag on;

        proposal {

                encryption_algorithm aes;

                hash_algorithm sha1;

                authentication_method hybrid_rsa_server;

                dh_group 2;

        }

}

 

mode_cfg {

        network4 10.99.99.0;

        pool_size 255;

        netmask4 255.255.255.0;

        auth_source system;

        dns4 10.0.12.1;

        wins4 10.0.12.1;

        banner "/etc/racoon/motd";

        pfs_group 2;

}

 

sainfo anonymous {

        pfs_group 2;

        lifetime time 1 hour;

        encryption_algorithm aes;

        authentication_algorithm hmac_sha1;

        compression_algorithm deflate;

}

#---------------------------------

 

 

/etc/init.d/racoon start

 

ipsec server syslog:

Mar 27 17:43:23 bob racoon: INFO: @(#)ipsec-tools 0.6.6 (http://ipsec-tools.sourceforge.net)

Mar 27 17:43:23 bob racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)

Mar 27 17:43:23 bob racoon: NOTIFY: NAT-T is enabled, autoconfiguring ports

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=6)

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=7)

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used as isakmp port (fd=8)

Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used as isakmp port (fd=9)

Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=10)

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=11)

Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=12)

Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=13)

Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used for NAT-T

Mar 27 17:43:23 bob racoon: INFO: ::1[500] used as isakmp port (fd=18)

 Mar 27 17:43:23 bob racoon: INFO: ::1[4500] used as isakmp port (fd=19)