Hello list,
I am trying to move my IPsec configuration from isakmpd.conf to ipsec.conf.
However i cannot find a syntax to specify multiple transform suites with
ipsec.conf
I tried something like:
ike passive esp from any to any quick enc {aes,3des}
but it is rejected.
I want something like
Suites=QM-ESP-AES-SHA2-256-PFS-SUITE,QM-ESP-3DES-PFS-SUITE
as a result.
As a workaround i can stuff it into the running configuration using
isakmpd's fifo, but that is not a very robust solution.
Specifying
Default-phase-2-suites =
QM-ESP-3DES-MD5-PFS-SUITE,QM-ESP-AES-SHA2-256-PFS-SUITE
in isakmpd.conf
does not help, because ipsecctl overrides it. Is there a way to tell
ipsecctl to not specify a suite at all, so that the default is used?
BTW, is ipsec.conf meant to ever become a full replacement for isakmpd.conf?
Thanks for any hints.
--
Heinrich Rebehn
University of Bremen
Physics / Electrical and Electronics Engineering
- Department of Telecommunications -
Phone : +49/421/218-4664
Fax : -3341
