Damon McMahon wrote:

quoted text
>> From: Heinrich Rebehn

>> Date: 29 October 2007 9:14:16 PM

>> To: OpenBSD

>> Subject: Hoe to specify multiple transform suites in ipsec.conf(5)

>>

>>

>> Hello list,

>>

>> I am trying to move my IPsec configuration from isakmpd.conf to

>> ipsec.conf.

>> However i cannot find a syntax to specify multiple transform suites

>> with ipsec.conf

>>

>> I tried something like:

>>

>> ike passive esp from any to any quick enc {aes,3des}

>>

>> but it is rejected.

>>

>> I want something like

>>

>> Suites=QM-ESP-AES-SHA2-256-PFS-SUITE,QM-ESP-3DES-PFS-SUITE

>>

>> as a result.

>> As a workaround i can stuff it into the running configuration using

>> isakmpd's fifo, but that is not a very robust solution.

>>

>> Specifying

>>

>> Default-phase-2-suites  =

>> QM-ESP-3DES-MD5-PFS-SUITE,QM-ESP-AES-SHA2-256-PFS-SUITE

>>

>> in isakmpd.conf

>> does not help, because ipsecctl overrides it. Is there a way to tell

>> ipsecctl to not specify a suite at all, so that the default is used?

>>

>> BTW, is ipsec.conf meant to ever become a full replacement for

>> isakmpd.conf?

>>

>> Thanks for any hints.

>> --

>

> Heinrich,

>

> I've tried to do the same - see

> http://readlist.com/lists/openbsd.org/misc/12/62613.html - as of 4.1

> this is not supported by ipsec.conf(5).

>

> Best wishes,

> Damon

>

Thanks for your reply, Damon. I missed your post when searching the

archives.

You wrote that isakmpd.conf is "deprecated". Obviously this is not (yet)

quite so.

Kind regards,
	Heinrich