# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.4 2006/07/11 16:17:53 paul Exp $

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version	2.0	# conforms to second version of ipsec.conf specification

# basic configuration
config setup
	# plutodebug / klipsdebug = "all", "none" or a combation from below:
	# "raw crypt parsing emitting control klips pfkey natt x509 private"
	# eg:
	# plutodebug="control parsing"
	#
	# Only enable klipsdebug=all if you are a developer
	#
	# NAT-TRAVERSAL support, see README.NAT-Traversal
	nat_traversal=yes
	# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
	#
	# enable this if you see "failed to find any available worker"
	nhelpers=0
	interfaces="ipsec0=eth0"

# Add connections here
# SonicWall at Strocal, Inc.
conn sonicwall
    type=tunnel
    left=my.local.ip.addr
    leftnexthop=my.local.gw.ip
    leftsubnet=my.sub.net.ip/24
    leftid=@mylocalid
    right=sonic.wall.ip.addr
    rightsubnet=dest.sub.net.addr/16
    rightid=@sonicwalluniqueid
    keyingtries=0
    pfs=no
    aggrmode=no
    auto=add
    auth=esp
    ike=des3-sha1
    esp=des3-sha1
    authby=secret
    xauth=no
    keyexchange=ike

conn group
    type=tunnel
    left=my.local.gw.ip
    leftnexthop=my.local.gw.ip
    leftsubnet=my.sub.net.ip/24
    leftid=@mylocalid
    leftxauthclient=yes
    right=sonic.wall.ip.addr
    rightsubnet=dest.sub.net.addr/16
    rightid=@sonicwalluniqueid
    rightxauthserver=yes
    keyingtries=0
    pfs=no
    aggrmode=yes
    auto=add
    auth=esp
    ike=3des-sha1
    esp=3des-sha1
    authby=secret
    xauth=yes
    #keyexchange=ike

# sample VPN connections, see /etc/ipsec.d/examples/

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf
