# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.6 2006/10/19 03:49:46 paul Exp $

# This file:  /usr/share/doc/packages/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5

version	2.0	# conforms to second version of ipsec.conf specification

# basic configuration
config setup
	# plutodebug / klipsdebug = "all", "none" or a combation from below:
	# "raw crypt parsing emitting control klips pfkey natt x509 private"
	# eg: plutodebug="control parsing"
	#
	# ONLY enable plutodebug=all or klipsdebug=all if you are a developer !!
	#
	# NAT-TRAVERSAL support, see README.NAT-Traversal
	nat_traversal=yes
	# virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
	#
	# Certificate Revocation List handling:
	#crlcheckinterval=600
	#strictcrlpolicy=yes
	# 
	# Protocol stack is NETKEY (suggested by Paul)
	protostack=netkey
	#
	# Change rp_filter setting? (default is 0, disabled)
	# See also setting in the /etc/sysctl.conf file!
	#rp_filter=%unchanged
	#
	# Workaround to setup all tunnels immediately, since the new default
	# of "plutowait=no" causes "Resource temporarily unavailable" errors
	# for the first connect attempt over each tunnel, that is delayed to
	# be established later / on demand.
	# With "plutowait=yes" plutio waits for each negotiation attempt
	# that is part of startup to finish, before proceeding with the next.
	plutowait=yes
	#
	# enable this if you see "failed to find any available worker"
	nhelpers=0

# default settings for connections
conn %default
	# keyingtries default to %forever
	#keyingtries=3
	# Sig keys (default: %dnsondemand)
	leftrsasigkey=%cert
	rightrsasigkey=%cert
	# Lifetimes, defaults are 1h/8hrs
	#ikelifetime=20m
	#keylife=1h
	#rekeymargin=8m

# Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf

# Include office conf
include /etc/ipsec.d/theoffice.conf

