# ipsec client config file
path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";
listen {
adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
}
remote 10.0.0.1 {
exchange_mode aggressive;
ca_type x509 "root-ca.crt";
proposal_check obey;
nat_traversal on;
ike_frag on;
mode_cfg on;
script "/etc/racoon/phase1-up.sh" phase1_up;
script "/etc/racoon/phase1-down.sh" phase1_down;
passive off;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method hybrid_rsa_client;
dh_group 2;
}
}
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate ;
}
ipsec server config file
path certificate "/etc/openssl/certs";
listen {
adminsock disabled;
}
remote anonymous {
exchange_mode aggressive;
certificate_type x509 "my_certificate.pem" "my_private_key.pem";
my_identifier asn1dn;
proposal_check claim;
generate_policy on;
nat_traversal on;
dpd_delay 20;
ike_frag on;
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method hybrid_rsa_server;
dh_group 2;
}
}
mode_cfg {
network4 10.99.99.0;
pool_size 255;
netmask4 255.255.255.0;
auth_source system;
dns4 10.0.12.1;
wins4 10.0.12.1;
banner "/etc/racoon/motd";
pfs_group 2;
}
sainfo anonymous {
pfs_group 2;
lifetime time 1 hour;
encryption_algorithm aes;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
#---------------------------------
/etc/init.d/racoon start
ipsec server syslog:
Mar 27 17:43:23 bob racoon: INFO: @(#)ipsec-tools 0.6.6 (http://ipsec-tools.sourceforge.net)
Mar 27 17:43:23 bob racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
Mar 27 17:43:23 bob racoon: NOTIFY: NAT-T is enabled, autoconfiguring ports
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=6)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=7)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used as isakmp port (fd=8)
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used as isakmp port (fd=9)
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=10)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=11)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=12)
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=13)
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: ::1[500] used as isakmp port (fd=18)
Mar 27 17:43:23 bob racoon: INFO: ::1[4500] used as isakmp port (fd=19)