jcarr
/
wit-network-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ipsec: removing old proposal now that we are 100% upgraded, also tweaking some settings making use of ikev2

This commit is contained in:
toby 2018-11-30 18:27:18 +01:00
parent 83e0ccc728
commit 91e34ea5e1
4 changed files with 12 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
debian/wit-network-config.postinst vendored
View File

@ -394,6 +394,7 @@ case "$1" in
systemctl enable systemd-timesyncd
systemctl restart systemd-timesyncd
systemctl restart ssh
systemctl reload strongswan
update-grub

8
files/ipsec.conf.wit
View File

@ -10,9 +10,13 @@ conn %default
dpddelay=2
dpdaction=hold
#closeaction=none
#rekeyfuzz = 100%
ikelifetime = 4h
margintime = 12m
reauth = no
type=transport
ike=aes256-sha512-modp4096,aes128-sha1-modp2048!
esp=aes256-sha512-modp4096,aes128-sha1-modp2048!
ike=aes256-sha512-modp4096!
esp=aes256-sha512-modp4096!
leftcert=FQHOSTNAME.crt
leftid="C=US, O=Wit, CN=FQHOSTNAME"
rightid="C=US, O=Wit, CN=*"

1
files/wit-logging.conf
View File

@ -2,6 +2,7 @@ charon {
install_routes = no
install_virtual_ip = no
interfaces_use = lo
make_before_break = yes
syslog {
auth {
ike_name = yes

8
files/wit-swanctl.conf
View File

@ -3,7 +3,7 @@ connections {
version = 1
local_addrs = LOOPBACKv4
remote_addrs = %any4
proposals = aes256-sha512-modp4096,aes128-sha1-modp2048
proposals = aes256-sha512-modp4096
local {
auth = pubkey
@ -22,7 +22,7 @@ connections {
local_ts = LOOPBACKv4
mode = transport
start_action = trap
esp_proposals = aes256-sha512-modp4096,aes128-sha1-modp2048
esp_proposals = aes256-sha512-modp4096
}
}
}
@ -31,7 +31,7 @@ connections {
version = 1
local_addrs = LOOPBACKv6
remote_addrs = %any6
proposals = aes256-sha512-modp4096,aes128-sha1-modp2048
proposals = aes256-sha512-modp4096
local {
auth = pubkey
@ -50,7 +50,7 @@ connections {
local_ts = LOOPBACKv6
mode = transport
start_action = trap
esp_proposals = aes256-sha512-modp4096,aes128-sha1-modp2048
esp_proposals = aes256-sha512-modp4096
}
}
}