# $Id: tunnel_ike_natt.conf,v 1.8 2007/12/26 09:32:16 mk Exp $
# ike tunnel mode (esp) nat-t (responder side)
remote ike_tun_natt_remote {
	acceptable_kmp { ikev2; };
	ikev2 {
		my_id fqdn "${MY_FQDN}";
		peers_id fqdn "${PEERS_FQDN}";
		peers_ipaddr IP_RW;
		kmp_enc_alg { aes192_cbc; aes128_cbc; 3des_cbc; };
		kmp_prf_alg { hmac_md5; hmac_sha1; aes_xcbc; };
		kmp_hash_alg { hmac_sha1; };
		kmp_dh_group { modp2048; };
		## Use Preshared Key
		kmp_auth_method { psk; };
		pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
		## Use Certificate
		#kmp_auth_method { rsasig; };
		#my_public_key x509pem "${CERTDIR}/${MY_PUB_KEY}" "${CERTDIR}/${MY_PRI_KEY}";
		#peers_public_key x509pem "${CERTDIR}/${PEERS_PUB_KEY}" "";
                ## CP: provide to the remote node (server side)
		#provide {
		#	addresspool ike_tun_pool;
		#	dns { "${CP_DNS}"; };
		#	dhcp { "${CP_DHCP}"; };
		#	application_version "${CP_APPVER}";
		#};
	};
	selector_index ike_tun_natt_sel_in;
};

selector ike_tun_natt_sel_out {
	direction outbound;
	src "${MY_NET}";
	dst "${PEERS_NET}";
	policy_index ike_tun_natt_policy;
};

selector ike_tun_natt_sel_in {
	direction inbound;
	dst "${MY_NET}";
	src "${PEERS_NET}";
	policy_index ike_tun_natt_policy;
};

policy ike_tun_natt_policy {
	action auto_ipsec;
	remote_index ike_tun_natt_remote;
	ipsec_mode tunnel;
	ipsec_index { ipsec_esp; };
	ipsec_level require;
	peers_sa_ipaddr IP_RW;
	my_sa_ipaddr "${MY_GWADDRESS}";
};
