#

#ident "%Z%%M% %I% %E% SMI"

#

# Copyright 2005 Sun Microsystems, Inc. All rights reserved.

# Use is subject to license terms.

#

# CDDL HEADER START

#

# The contents of this file are subject to the terms of the

# Common Development and Distribution License, Version 1.0 only

# (the "License"). You may not use this file except in compliance

# with the License.

#

# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

# or http://www.opensolaris.org/os/licensing.

# See the License for the specific language governing permissions

# and limitations under the License.

#

# When distributing Covered Code, include this CDDL HEADER in each

# file and include the License file at usr/src/OPENSOLARIS.LICENSE.

# If applicable, add the following below this CDDL HEADER, with the

# fields enclosed by brackets "[]" replaced with your own identifying

# information: Portions Copyright [yyyy] [name of copyright owner]

#

# CDDL HEADER END

#

##

## This file should be copied into /etc/inet/ike/config to enable the

## launch of the IKE daemon, in.iked(1m), at boot time. You can also

## launch the IKE daemon after creating this file without rebooting by

## invoking /usr/lib/inet/in.iked with a root shell.

##

# Consult the ike.config(4) man page for further details. Here is a small

# example from the man page.

### BEGINNING OF FILE

### First some global parameters...

## Optional hardware acceleration parameters...

## Use the pathname of a library that supports PKCS#11 in quotes.

## The example path is for the Sun Crypto Accelerator 1000.

# pkcs11_path "/opt/SUNWconn/lib/libpkcs11.so"

## certificate parameters...

# Root certificates. I SHOULD use a full Distinguished Name.

# I MUST have this certificate in my local filesystem, see ikecert(1m).

cert_root "C=US, O=Sun Microsystems\\, Inc., CN=Sun CA"

# Explicitly trusted certs that need no signatures, or perhaps self-signed

# ones. Like root certificates, use full DNs for them for now.

cert_trust "EMAIL=root@domain.org"

# Where do I send LDAP requests?

ldap_server "ldap1.domain.org,ldap2.domain.org:389"

# Some PKI-specific tweaks...

# If you wish to ignore CRLs, uncomment this:

#ignore_crls

# If you wish to use HTTP (with name resolution) for URLs inside certs,

# uncomment this:

#use_http

# HTTP proxy and socks URLs should also be indicated if needed...

socks "socks://socks-relay.domain.org"

#proxy "http://http-proxy.domain.org:8080"

## Phase 1 transform defaults...

p1_lifetime_secs 14400

p1_nonce_len 20

## Parameters that may also show up in rules.

p1_xform { auth_method preshared oakley_group 5 auth_alg sha encr_alg 3des }

p2_pfs 2

### Now some rules...

{

label "simple inheritor"

local_id_type ip

local_addr 10.1.1.1

remote_addr 10.1.1.2

}

{

# an index-only rule. If I'm a receiver, and all I

# have are index-only rules, what do I do about inbound IKE requests?

# Answer: Take them all!

label "default rule"

# Use whatever "host" (e.g. IP address) identity is appropriate

local_id_type ipv4

local_addr 0.0.0.0/0

remote_addr 0.0.0.0/0

p2_pfs 5

# Now I'm going to have the p1_xforms

p1_xform

{auth_method preshared oakley_group 5 auth_alg md5 encr_alg blowfish }

p1_xform

{auth_method preshared oakley_group 5 auth_alg md5 encr_alg 3des }

# After said list, another keyword (or a '}') will stop xform parsing.

}

{

# Let's try something a little more conventional.

label "host to .80 subnet"

local_id_type ip

local_id "10.1.86.51"

remote_id "" # Take any, use remote_addr for access control.

local_addr 10.1.86.51

remote_addr 10.1.80.0/24

p1_xform

{ auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg 3des }

p1_xform

{ auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish }

p1_xform

{ auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg 3des }

p1_xform

{ auth_method rsa_sig oakley_group 5 auth_alg sha1 encr_alg blowfish }

}