# $Id: tunnel_ike.conf,v 1.15 2007/12/25 09:49:16 mk Exp $
# ike tunnel mode (esp) (includes a nat-t tunnel mode initiator side)
remote ike_tun_remote {
	acceptable_kmp { ikev2; ikev1; };
	ikev2 {
		my_id fqdn "${MY_FQDN}";
		peers_id fqdn "${PEERS_FQDN}";
		peers_ipaddr "${PEERS_GWADDRESS}" port 500;
		kmp_enc_alg { aes192_cbc; aes128_cbc; 3des_cbc; };
		kmp_prf_alg { hmac_md5; hmac_sha1; aes_xcbc; };
		kmp_hash_alg { hmac_sha1; };
		kmp_dh_group { modp2048; };
		## Use Preshared Key
		kmp_auth_method { psk; };
		pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
		## Use Certificate
		#kmp_auth_method { rsasig; };
		#my_public_key x509pem "${CERTDIR}/${MY_PUB_KEY}" "${CERTDIR}/${MY_PRI_KEY}";
		#peers_public_key x509pem "${CERTDIR}/${PEERS_PUB_KEY}" "";
                ## CP: provide to the remote node (server side)
		#provide {
		#	addresspool ike_tun_pool;
		#	dns { "${CP_DNS}"; };
		#	dhcp { "${CP_DHCP}"; };
		#	application_version "${CP_APPVER}";
		#};
		## CP: request to the remote node (client side)
		#request { ip4_dns; ip4_dhcp; application_version; };
		## run scripts
		#script {
		#	ike_sa_up    "${IKESAUP_SCR}";    #== IKE_SA up
		#	ike_sa_down  "${IKESADOWN_SCR}";  #== IKE_SA down
		#	ike_sa_rekey "${IKESAREKEY_SCR}"; #== IKE_SA rekey
		#	child_up     "${CHILDUP_SCR}";    #== CHILD_SA up
		#	child_down   "${CHILDOWN_SCR}";   #== CHILD_SA down
		#	child_rekey  "${CHILDREKEY_SCR}"; #== CHILD_SA rekey
		#	migration    "${MIGRATION_SCR}";  #== issueing MIP6 MIGRATE
		#};
	};
	ikev1 {
		my_id ipaddr "${MY_GWADDRESS}";
		peers_id ipaddr "${PEERS_GWADDRESS}";
		peers_ipaddr "${PEERS_GWADDRESS}" port 500;
		kmp_enc_alg { aes192_cbc; aes128_cbc; 3des_cbc; };
		kmp_hash_alg { sha1; };
		kmp_dh_group { modp2048; };
		## Use Preshared Key
		kmp_auth_method { psk; };
		pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
		## Use Certificate
		#kmp_auth_method { rsasig; };
		#my_public_key x509pem "${CERTDIR}/${MY_PUB_KEY}" "${CERTDIR}/${MY_PRI_KEY}";
		#peers_public_key x509pem "${CERTDIR}/${PEERS_PUB_KEY}" "";
		## run scripts
		#script {
		#	phase1_up   "${PH1UP_SCR}";      #== Phase1 up
		#	phase1_down "${PH1DOWN_SCR}";    #== Phase1 down
		#};
	};
	selector_index ike_tun_sel_in;
};

## address pool for CP
#addresspool ike_tun_pool {
#	"${CP_ADDRPL4_START}" - "${CP_ADDRPL4_END}";
#	"${CP_ADDRPL6_START}" - "${CP_ADDRPL6_END}";
#};

selector ike_tun_sel_out {
	direction outbound;
	src "${MY_NET}";
	dst "${PEERS_NET}";
	policy_index ike_tun_policy;
};

selector ike_tun_sel_in {
	direction inbound;
	dst "${MY_NET}";
	src "${PEERS_NET}";
	policy_index ike_tun_policy;
};

policy ike_tun_policy {
	action auto_ipsec;
	remote_index ike_tun_remote;
	ipsec_mode tunnel;
	ipsec_index { ipsec_esp; };
	ipsec_level require;
	peers_sa_ipaddr "${PEERS_GWADDRESS}";
	my_sa_ipaddr "${MY_GWADDRESS}";
};
