# $Id: default.conf,v 1.7 2009/03/24 06:13:24 mk Exp $
#
# default section
#
default
{
	remote {
		acceptable_kmp { ikev2; ikev1; kink; };
		ikev1 {
			logmode normal;
			kmp_sa_lifetime_time 28800 sec;
			kmp_sa_lifetime_byte infinite;
			interval_to_send 10 sec;
			times_per_send 1;
			ipsec_sa_nego_time_limit 40 sec;
			kmp_enc_alg { aes128_cbc; 3des_cbc; };
			kmp_hash_alg { sha1; };
			kmp_dh_group { modp2048; modp1024; };
			kmp_auth_method { psk; };
			random_pad_content on;
			my_id ipaddr "${MY_IPADDRESS}";
			# max_padlen 50 bytes;
			## Default pre-shared key (should be a strong key)
			## You can disable this if you do not need
			## a pre-shared key for the wildcard address
			pre_shared_key "${PSKDIR}/${PRESHRD_KEY}";
			## Default scripts for phase 1 up/down
			script { phase1_up "${PH1UP_SCR}";
				 phase1_down "${PH1DOWN_SCR}"; };
		};
		ikev2 {
			logmode normal;
			kmp_sa_lifetime_time infinite;
			kmp_sa_lifetime_byte infinite;
			max_retry_to_send 3;
			interval_to_send 10 sec;
			times_per_send 1;
			kmp_sa_nego_time_limit 60 sec;
			#ipsec_sa_nego_time_limit 40 sec;
			kmp_enc_alg { aes128_cbc; 3des_cbc; };
			kmp_prf_alg { hmac_md5; hmac_sha1; aes_xcbc; };
			kmp_hash_alg { hmac_sha1; hmac_md5; };
			kmp_dh_group { modp3072; modp2048; modp1024;  };
			kmp_auth_method { psk; };
			random_pad_content on;
			random_padlen on;
			max_padlen 50 bytes;
		};
		kink {
			my_principal "${MY_PRINCIPAL}";
			nonce_size 16 B;
		};
	};

	policy {
		ipsec_mode transport;
		ipsec_level require;
	};

	ipsec {
		ipsec_sa_lifetime_time infinite;
		ipsec_sa_lifetime_byte infinite;
	};

	sa {
		esp_enc_alg { aes128_cbc; 3des_cbc; };
		esp_auth_alg { hmac_sha1; };
	};
};
ipsec ipsec_ah_esp {
	ipsec_sa_lifetime_time 3600 sec;
	sa_index { ah_01; esp_01; };
};
ipsec ipsec_esp {
	ipsec_sa_lifetime_time 3600 sec;
	sa_index esp_01;
};

sa ah_01 {
	sa_protocol ah;
	ah_auth_alg { hmac_sha1; hmac_md5; };
};
sa esp_01 {
	sa_protocol esp;
	esp_enc_alg { aes128_cbc; 3des_cbc; };
	esp_auth_alg { hmac_sha1; };
};
