57 lines
1000 B
Plaintext
57 lines
1000 B
Plaintext
config setup
|
|
#strictcrlpolicy=yes
|
|
cachecrls=yes
|
|
|
|
|
|
conn %default
|
|
#keyexchange=ikev2
|
|
keyingtries=%forever
|
|
dpdtimeout=10
|
|
dpddelay=2
|
|
dpdaction=hold
|
|
#closeaction=none
|
|
#rekeyfuzz = 100%
|
|
ikelifetime = 4h
|
|
margintime = 12m
|
|
reauth = no
|
|
type=transport
|
|
ike=aes256-sha512-modp4096!
|
|
esp=aes256-sha512-modp4096!
|
|
leftcert=FQHOSTNAME.crt
|
|
leftid="C=US, O=Wit, CN=FQHOSTNAME"
|
|
rightid="C=US, O=Wit, CN=*"
|
|
auto=route
|
|
|
|
|
|
conn local4
|
|
left=LOOPBACKv4
|
|
leftsubnet=LOOPBACKv4
|
|
right=LOOPBACKv4
|
|
rightsubnet=LOOPBACKv4
|
|
auth=none
|
|
type=passthrough
|
|
|
|
|
|
conn loopback4
|
|
left=LOOPBACKv4
|
|
leftsubnet=LOOPBACKv4
|
|
right=IPSEC_IPV4_SUBNETS
|
|
rightsubnet=IPSEC_IPV4_SUBNETS
|
|
|
|
|
|
conn local6
|
|
left=LOOPBACKv6
|
|
leftsubnet=LOOPBACKv6
|
|
right=LOOPBACKv6
|
|
rightsubnet=LOOPBACKv6
|
|
auth=none
|
|
type=passthrough
|
|
|
|
|
|
conn loopback6
|
|
left=LOOPBACKv6
|
|
leftsubnet=LOOPBACKv6
|
|
right=%any6
|
|
rightsubnet=IPSEC_IPV6_SUBNETS
|
|
|