gw1: racoon.conf# File with key ID/key pairs, for pre-shared key authentication.
path pre_shared_key "/etc/racoon/psk.txt";
# "log" specifies logging level. It is followed by either "notify", "debug" or "debug2".
log notify;
# "padding" defines some padding parameters. You should not touch these.
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
# Specify various default timers.
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 30 sec;
phase2 15 sec;
}
# if no listen directive is specified, racoon will listen on all
# available interface addresses.
listen
{
isakmp 192.168.21.10 [500]; # IP [port] for ISAKMP protocol
isakmp_natt 192.168.21.10 [4500]; # IP [port] for NAT-T protocol
strict_address; # requires that all addresses must be bound.
}
remote 192.168.21.11 {
exchange_mode main;
nat_traversal on;
proposal {
encryption_algorithm 3des;
hash_algorithm md5;
authentication_method pre_shared_key;
dh_group modp1024;
}
}
sainfo address 192.168.21.10/24 any address 192.168.21.11/24 any {
pfs_group modp1024;
lifetime time 30 min;
encryption_algorithm 3des;
authentication_algorithm hmac_md5;
compression_algorithm deflate;
}
gw1: setkey.conf
# /usr/sbin/setkey -f
#
# Flush SAD and SPD
flush;
spdflush;
# Create policies for racoon
spdadd 192.168.21.10/24 192.168.21.11/24 any -P out
ipsec esp/tunnel/192.168.21.10-192.168.21.11/require;
spdadd 192.168.21.11/24 192.168.21.10/24 any -P in
ipsec esp/tunnel/192.168.21.11-192.168.21.10/require;
gw1: psk.txt
# file for pre-shared keys used for IKE authentication
# format is: 'identifier' 'key'
# For example:
#
# 10.1.1.1 flibbertigibbet
# www.example.com 12345
# foo@www.example.com micropachycephalosaurus
192.168.21.11 psk_123321
Вариант для распечатки
(ok) on 26-Окт-12, 15:41 
