# cat /etc/isakmpd/isakmpd.conf  
[General]
Listen-on=              201.12.35.xx
Default-phase-1-lifetime=       ANY
Default-phase-2-lifetime=       ANY

[Phase 1]
Default=                openbsd-checkpoint

[Phase 2]
Connections=            sicredi

[openbsd-checkpoint]
Phase=                  1
Transport=              udp
Local-address=          201.12.35.xx
Address=                201.77.95.xx
Configuration=          Default-main-mode
Authentication=         SICredi

[sicredi]
Phase=                  2
ISAKMP-peer=            openbsd-checkpoint
Configuration=          Default-quick-mode
Local-ID=               central-network
Remote-ID=              sicredi-network

[central-network]
ID-type=                IPV4_ADDR_SUBNET
Network=                192.168.1.0
Netmask=                255.255.255.0

[sicredi-network]
ID-type=                IPV4_ADDR_SUBNET
Network=                172.16.0.0
Netmask=                255.240.0.0

[Default-main-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          ID_PROT
Transforms=             DES-SHA

[Default-quick-mode]
DOI=                    IPSEC
EXCHANGE_TYPE=          QUICK_MODE
Suites=                 QM-ESP-DES-SHA-SUITE
# 

# cat /etc/isakmpd/isakmpd.policy                                                                          
KeyNote-Version: 2
Authorizer: "POLICY"
Conditions: app_domain == "IPsec policy" &&
                esp_present == "yes" &&
                esp_enc_alg != "null" -> "true";
#