Realisations/2006-2007/Projet/IpsecImplementation: racoon.conf

#  $File: /home/chris/PRes/Postes_Rackables/ipsec_client1/racoon.conf $
#  $MD5: 2922df40b60a8f1eb7116f90a485f84a $
#  $By Christophe Alladoum <christophe[dot]alladoum[at]gmail[dot]com>$
#  $Last-Modified: Fri Apr 20 18:28:11 2007$

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

#
# Configuration de RACOON cote client
#

path include "/root/ipsec_client1" ;
path pidfile "/root/ipsec_client1/racoon.pid";
path pre_shared_key "/root/ipsec_client1/psk.txt" ;

# "log" indique le niveau de debug
# choix : notify, debug, debug2
# log debug;

padding
{
        maximum_length 20;      # maximum padding length.
        randomize off;          # enable randomize length.
        strict_check off;       # enable strict check.
        exclusive_tail off;     # extract last one octet.
}

# Interfaces a ecouter (IPv4 et/ou v6)
# Si aucune, ecoute sur toutes les interfaces de la machine
listen
{
        # pour le client IPv4
        isakmp 10.40.0.13 [500];
        # pour le client IPv6
        # isakmp ::1 [7000];
}

# Temporisateurs d echange de cle
timer
{
        counter 5;              # maximum trying count to send.
        interval 20 sec;        # maximum interval to resend.
        persend 1;              # the number of packets per a send.

        # Temps max. pour chaque phase
        phase1 2 min;
        phase2 4 min;
}

# Cas du client1
remote 10.40.0.9
{
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;

        nonce_size 16;
        lifetime time 60 min;   # sec,min,hour
        initial_contact on;
        support_proxy on;
        proposal_check obey;    # obey, strict or claim

        proposal {
                encryption_algorithm blowfish;
                hash_algorithm sha1;
                authentication_method pre_shared_key ;
                dh_group 5 ;
        }
}

# Cas du client1
sainfo anonymous
{
        pfs_group 5;
        lifetime time 48 hour;
        encryption_algorithm 3des, cast128, blowfish 448, des;
        authentication_algorithm hmac_md5, hmac_sha1;
        compression_algorithm deflate ;
}