#  $File: /home/chris/PRes/Postes_Rackables/ipsec_client1/racoon.conf $
#  $MD5: 2922df40b60a8f1eb7116f90a485f84a $
#  $By Christophe Alladoum <christophe[dot]alladoum[at]gmail[dot]com>$
#  $Last-Modified: Fri Apr 20 18:28:11 2007$

# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation; either version 2 of the License, or
# (at your option) any later version.

# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.

# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA

#
# Configuration de RACOON cote client
#

path include "/root/ipsec_client1" ;
path pidfile "/root/ipsec_client1/racoon.pid";
path pre_shared_key "/root/ipsec_client1/psk.txt" ;

# "log" indique le niveau de debug
# choix : notify, debug, debug2
# log debug;

padding
{
	maximum_length 20;	# maximum padding length.
	randomize off;		# enable randomize length.
	strict_check off;	# enable strict check.
	exclusive_tail off;	# extract last one octet.
}

# Interfaces a ecouter (IPv4 et/ou v6)
# Si aucune, ecoute sur toutes les interfaces de la machine
listen
{
	# pour le client IPv4
	isakmp 10.40.0.13 [500];
	# pour le client IPv6
	# isakmp ::1 [7000];
}

# Temporisateurs d echange de cle
timer
{
	counter 5;		# maximum trying count to send.
	interval 20 sec;	# maximum interval to resend.
	persend 1;		# the number of packets per a send.

	# Temps max. pour chaque phase
	phase1 2 min;
	phase2 4 min;
}

# Cas du client1
remote 10.40.0.9
{
	exchange_mode aggressive,main;
	doi ipsec_doi;
	situation identity_only;

	nonce_size 16;
	lifetime time 60 min;	# sec,min,hour
	initial_contact on;
	support_proxy on;
	proposal_check obey;	# obey, strict or claim

	proposal {
		encryption_algorithm blowfish;
		hash_algorithm sha1;
		authentication_method pre_shared_key ;
		dh_group 5 ;
	}
}

# Cas du client1
sainfo anonymous
{
	pfs_group 5;
	lifetime time 48 hour;
	encryption_algorithm 3des, cast128, blowfish 448, des;
	authentication_algorithm hmac_md5, hmac_sha1;
	compression_algorithm deflate ;
}