# $Id: transport_ike.conf,v 1.7 2007/12/26 08:00:53 sinoue Exp $

## ike transport mode (esp/udp port 1701) suitable for L2TP/IPsec VPN server
## Please modify as needed for your scenario

## If peer's address is not known, you can use IP_ANY for PEERS_IP_ADDRESS in
## vals.conf. IP_ANY for the peer works with Windows and iphone IKEv1 L2TP/IPSec
## roaming clients using IPv4 addresses. IKEv2 and IPv6 has not been tested yet.

remote ike_trans_remote {
	acceptable_kmp { ikev2; ikev1; };
	ikev2 {
		my_id fqdn "${MY_FQDN}";
		peers_id fqdn "${PEERS_FQDN}";
		peers_ipaddr "${PEERS_IPADDRESS}" port 500;
		## Use Preshared Key
		kmp_auth_method { psk; };
		pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
		## Use Certificate
		#kmp_auth_method { rsasig; };
		#my_public_key x509pem "${CERTDIR}/${MY_PUB_KEY}" "${CERTDIR}/${MY_PRI_KEY}";
		#peers_public_key x509pem "${CERTDIR}/${PEERS_PUB_KEY}" "";
	};
	ikev1 {
		## If your role is a server/responder only
		#passive on;
		## When you use fqdn to identify each side
		#my_id fqdn "${MY_FQDN}";
		#peers_id fqdn "${PEERS_FQDN}";
		## When you use ip addresses to identify each side
		my_id ipaddr "${MY_IPADDRESS}";
		peers_id ipaddr "${PEERS_IPADDRESS}";
		## Always enable this (if peer is behind NAT, use peer's public
		## IP or IP_ANY for PEERS_IPADDRESS in vals.conf)
		peers_ipaddr "${PEERS_IPADDRESS}";
		## This setting will generate policy - not functional yet
		#peers_ipaddr IP_RW;
		## Use Preshared Key
		kmp_auth_method { psk; };
		pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
		## Use Certificate
		#kmp_auth_method { rsasig; };
		#my_public_key x509pem "${CERTDIR}/${MY_PUB_KEY}" "${CERTDIR}/${MY_PRI_KEY}";
		#peers_public_key x509pem "${CERTDIR}/${PEERS_PUB_KEY}" "";
		proposal_check obey;
		script { phase1_up "${PH1UP_SCR}";
			 phase1_down "${PH1DOWN_SCR}"; };
	};
	selector_index ike_trans_sel_in;
};

## Selectors for no NAT case (also needed for NAT-T case)
selector ike_trans_sel_out {
	direction outbound;
	src "${MY_IPADDRESS}" port 1701;
	dst "${PEERS_IPADDRESS}" port any;
	## IP_RW not functional yet
	#dst IP_RW port any;
	upper_layer_protocol "udp";
	policy_index ike_trans_policy;
};

selector ike_trans_sel_in {
	direction inbound;
	dst "${MY_IPADDRESS}" port 1701;
	src "${PEERS_IPADDRESS}" port any;
	## IP_RW not functional yet
	#src IP_RW port any;
	upper_layer_protocol "udp";
	policy_index ike_trans_policy;
};

## Uncomment to enable NAT-T transport mode support
# include "@prefix@/etc/racoon2/transport_ike_natt.conf";

policy ike_trans_policy {
	action auto_ipsec;
	remote_index ike_trans_remote;
	ipsec_mode transport;
	ipsec_index { ipsec_esp; };
	ipsec_level require;
	## IP_RW not functional yet
	#peers_sa_ipaddr IP_RW;
	#my_sa_ipaddr "${MY_IPADDRESS}";
};
