path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";
log debug;
padding {
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
remote anonymous {
exchange_mode main;
my_identifier fqdn "vpn.xxx.xxx";
passive on;
generate_policy on;
nat_traversal on;
# desktop clients
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 14;
}
# iOS clients
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method xauth_psk_server;
dh_group 2;
lifetime time 1 hour;
}
proposal {
encryption_algorithm aes;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp1024;
}
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group modp1024;
}
# Android clients
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2;
}
}
sainfo anonymous {
encryption_algorithm aes, 3des;
authentication_algorithm hmac_sha1, hmac_md5;
compression_algorithm deflate;
}
###########
listen {
isakmp_natt 1.1.1.1 [4500];
isakmp 1.1.1.1 [500];
}
timer {
counter 100000;
interval 5 sec;
persend 1;
phase1 30 sec;
phase2 15 sec;
}
remote 2.2.2.2 {
exchange_mode main;
my_identifier address "1.1.1.1";
peers_identifier address "2.2.2.2";
initial_contact on;
proposal_check obey;
proposal {
encryption_algorithm aes256;
authentication_method pre_shared_key;
hash_algorithm sha1;
dh_group 2;
}
}
sainfo address 0.0.0.0/0 any address 192.168.0.0/16 any {
lifetime time 28800 seconds;
encryption_algorithm aes256;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
pfs_group 2;
}
charon {
# Section to define file loggers, see LOGGER CONFIGURATION in
# strongswan.conf(5).
filelog {
# <filename> is the full path to the log file.
/var/log/ipsec {
# Loglevel for a specific subsystem.
# <subsystem> = <default>
# If this option is enabled log entries are appended to the existing
# file.
append = yes
# Default loglevel.
default = 2
# job management do not need to logging usually
job = 0
# For debugging purpose
asn = 1
enc = 1
ike = 4
net = 4
cfg = 3
# Enabling this option disables block buffering and enables line
# buffering.
flush_line = yes
# Prefix each log entry with the connection name and a unique
# numerical identifier for each IKE_SA.
ike_name = no
# Prefix each log entry with a timestamp. The option accepts a
# format string as passed to strftime(3).
time_format = %b %e %T
}
}
}
Простой
Средний
