iked.conf8
Internet key exchange daemon configuration file
Usage
The defined
parameter
types
are
as
follows ...
Overview
The iked.conf file is used to configure iked(8) ( Internet Key Exchange Daemon ). The parameters supplied are used to negotiate ISAKMP ( phase1 ) and IPsec ( phase2 ) SAs for IPsec capable hosts.
Examples
This section contains a few iked configuration examples.
The first example shows a configuration that only defines the parameters required to support client connectivity mode with NATT and debug options enabled.
daemon
{
socket ike 500;
socket natt 4500;
log_level debug;
log_file "/var/log/iked.log";
pcap_decrypt "/var/log/ike-decrypt.pcap";
pcap_encrypt "/var/log/ike-encrypt.pcap";
retry_delay 10;
retry_count 2;
}
The second example shows a configuration that supports simple peer to peer negotiations using mutual preshared key authentication.
daemon
{
socket ike 500;
log_level debug;
log_file "/var/log/iked.log";
}
peer 1.2.3.4
{
exchange main;
peerid local address;
peerid remote address;
authdata psk "sharedsecret";
life_check claim;
proposal isakmp
{
auth mutual_psk;
life_sec 28800;
life_kbs 0;
}
proposal esp
{
life_sec 3800;
life_kbs 0;
}
}
The third example shows a configuration that supports client gateway negotiations using mutual preshared key authentication with xauth, nat traversal, dead peer detection, ike fragmentation and policy generation. The daemon would allow xauth users that are members of the "remote" group to connect to the gateway. Policies would be generated to allow a peer access to the 10.1.1.0/24 and 1.3.3.0/24 networks with the exception of 1.1.1.15/32 which be accessed directly ( not via IPsec ). Peers that use an xauth user account that is a member of the "netadmin" group would have additional policies generated to allow access to the 10.4.4.0/24 network.
daemon
{
socket ike 500;
socket natt 4500;
log_level debug;
log_file "/var/log/iked.log";
pcap_decrypt "/var/log/ike-decrypt.pcap";
pcap_encrypt "/var/log/ike-encrypt.pcap";
}
netgroup allow
{
10.1.1.0/24;
10.3.3.0/24;
}
netgroup deny
{
1.1.1.15/32;
}
netgroup protect
{
10.4.4.0/24;
}
xconf_local
{
network4 10.2.1.0/24;
dnss4 10.1.1.1;
nbns4 10.1.1.1;
dns_suffix "foo.com";
dns_list "foo.com" "bar.com";
banner "/etc/iked.motd";
pfs_group 2;
}
peer 0.0.0.0
{
contact responder;
exchange main;
natt_mode enable;
dpd_mode enable;
frag_ike_mode enable;
peerid local address;
peerid remote address;
authdata psk "sharedsecret";
life_check claim;
xauth_source local "remote";
xconf_source local;
plcy_mode config;
plcy_list
{
include allow;
exclude deny;
include protect "netadmin";
}
proposal isakmp
{
auth mutual_xauth_psk;
ciph 3des;
hash md5;
dhgr 2;
life_sec 28800;
life_kbs 0;
}
proposal esp
{
life_sec 3800;
life_kbs 0;
}
}
Releases
Unchanged in 2 releases since Debian 8 (Jessie).