wit-network-config/files/ipsec.conf.wit

config setup
    #charondebug="all"
    #uniqueids=yes
    #strictcrlpolicy=yes
    cachecrls=yes

#ca ca-wit       #define alternative CRL distribution point
#    cacert=ca-wit.crt
#    crluri=ca-wit.crl
#    auto=add

conn %default
    keyingtries=%forever
    dpdtimeout=10
    dpddelay=3
    dpdaction=restart
    type=transport
    keyexchange=ikev1
    ike=aes256-sha512-modp4096,aes128-sha1-modp2048!
    esp=aes256-sha512-modp4096,aes128-sha1-modp2048!
    leftcert=FQHOSTNAME.crt
    leftid="C=US, O=Wit, CN=FQHOSTNAME"
    rightid="C=US, O=Wit, CN=*"
    auto=route


conn loopback4
    #leftsourceip=%config4
    left=LOOPBACKv4
    leftsubnet=LOOPBACKv4
    rightsubnet=IPSEC_IPV4_SUBNETS
    right=%any4


conn loopback6
    #leftsourceip=%config6
    left=LOOPBACKv6
    leftsubnet=LOOPBACKv6
    rightsubnet=IPSEC_IPV6_SUBNETS
    right=%any6
adding ipsec config as well 2018-07-27 15:34:21 -05:00			`config setup`
			`#charondebug="all"`
			`#uniqueids=yes`
			`#strictcrlpolicy=yes`
			`cachecrls=yes`

			`#ca ca-wit #define alternative CRL distribution point`
			`# cacert=ca-wit.crt`
			`# crluri=ca-wit.crl`
			`# auto=add`

			`conn %default`
			`keyingtries=%forever`
			`dpdtimeout=10`
			`dpddelay=3`
			`dpdaction=restart`
			`type=transport`
for now keeping the ikev1, the upgrade to v2 needs to be planned 2018-10-31 17:15:54 -05:00			`keyexchange=ikev1`
ipsec: adding new key-proposal that we wanna move towards to. once rolled out, we'd like to deprecate the old weak ones 2018-10-26 14:46:49 -05:00			`ike=aes256-sha512-modp4096,aes128-sha1-modp2048!`
			`esp=aes256-sha512-modp4096,aes128-sha1-modp2048!`
adding ipv6 tunnel to strongswan and matching firewall rules 2018-09-17 14:28:02 -05:00			`leftcert=FQHOSTNAME.crt`
			`leftid="C=US, O=Wit, CN=FQHOSTNAME"`
			`rightid="C=US, O=Wit, CN=*"`
			`auto=route`
adding ipsec config as well 2018-07-27 15:34:21 -05:00

adding ipv6 tunnel to strongswan and matching firewall rules 2018-09-17 14:28:02 -05:00			`conn loopback4`
ipsec: setting source IP to loopback 2018-10-31 17:06:30 -05:00			`#leftsourceip=%config4`
			`left=LOOPBACKv4`
setting leftsubnet to only be the local loopback instead of a wide range. this will avoid blackholing traffic for edges and potentially other nodes 2018-10-23 16:28:29 -05:00			`leftsubnet=LOOPBACKv4`
more work on edge.... adding support for dynamic ipsec subnets and some more minor patches 2018-10-19 12:57:07 -05:00			`rightsubnet=IPSEC_IPV4_SUBNETS`
adding ipv6 tunnel to strongswan and matching firewall rules 2018-09-17 14:28:02 -05:00			`right=%any4`


			`conn loopback6`
ipsec: setting source IP to loopback 2018-10-31 17:06:30 -05:00			`#leftsourceip=%config6`
			`left=LOOPBACKv6`
setting leftsubnet to only be the local loopback instead of a wide range. this will avoid blackholing traffic for edges and potentially other nodes 2018-10-23 16:28:29 -05:00			`leftsubnet=LOOPBACKv6`
more work on edge.... adding support for dynamic ipsec subnets and some more minor patches 2018-10-19 12:57:07 -05:00			`rightsubnet=IPSEC_IPV6_SUBNETS`
adding ipv6 tunnel to strongswan and matching firewall rules 2018-09-17 14:28:02 -05:00			`right=%any6`
adding ipsec config as well 2018-07-27 15:34:21 -05:00