Hello list,

I am trying to move my IPsec configuration from isakmpd.conf to ipsec.conf.
However i cannot find a syntax to specify multiple transform suites with 
ipsec.conf

I tried something like:

ike passive esp from any to any quick enc {aes,3des}

but it is rejected.

I want something like

Suites=QM-ESP-AES-SHA2-256-PFS-SUITE,QM-ESP-3DES-PFS-SUITE

as a result.
As a workaround i can stuff it into the running configuration using 
isakmpd's fifo, but that is not a very robust solution.

Specifying

Default-phase-2-suites  = 
QM-ESP-3DES-MD5-PFS-SUITE,QM-ESP-AES-SHA2-256-PFS-SUITE

in isakmpd.conf
does not help, because ipsecctl overrides it. Is there a way to tell 
ipsecctl to not specify a suite at all, so that the default is used?

BTW, is ipsec.conf meant to ever become a full replacement for isakmpd.conf?

Thanks for any hints.
-- 

Heinrich Rebehn

University of Bremen
Physics / Electrical and Electronics Engineering
- Department of Telecommunications -

Phone : +49/421/218-4664
Fax   :            -3341