# ipsec client config file
path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

listen {
        adminsock "/var/racoon/racoon.sock" "root" "operator" 0660;
}

remote 10.0.0.1 {
        exchange_mode aggressive;
        ca_type x509 "root-ca.crt";
        proposal_check obey;
        nat_traversal on;
        ike_frag on;
        mode_cfg on;
        script "/etc/racoon/phase1-up.sh" phase1_up;
        script "/etc/racoon/phase1-down.sh" phase1_down;
        passive off;
        proposal {
                encryption_algorithm aes;
                hash_algorithm sha1;
                authentication_method hybrid_rsa_client;
                dh_group 2;
        }
}
 
 
sainfo anonymous {
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm aes;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate ;
}
 
ipsec server config file
path certificate "/etc/openssl/certs";


listen {
        adminsock disabled;
}
 

remote anonymous {
        exchange_mode aggressive;
        certificate_type x509 "my_certificate.pem" "my_private_key.pem";
        my_identifier asn1dn;
        proposal_check claim;
        generate_policy on;
        nat_traversal on;
        dpd_delay 20;
        ike_frag on;
        proposal {
                encryption_algorithm aes;
                hash_algorithm sha1;
                authentication_method hybrid_rsa_server;
                dh_group 2;
        }
}
 
mode_cfg {
        network4 10.99.99.0;
        pool_size 255;
        netmask4 255.255.255.0;
        auth_source system;
        dns4 10.0.12.1;
        wins4 10.0.12.1;
        banner "/etc/racoon/motd";
        pfs_group 2;
}
 
sainfo anonymous {
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm aes;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}
#---------------------------------
 
 
/etc/init.d/racoon start
 
ipsec server syslog:
------------------------
Mar 27 17:43:23 bob racoon: INFO: @(#)ipsec-tools 0.6.6 (http://ipsec-tools.sourceforge.net)
Mar 27 17:43:23 bob racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
Mar 27 17:43:23 bob racoon: NOTIFY: NAT-T is enabled, autoconfiguring ports
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=6)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=7)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used as isakmp port (fd=8)
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used as isakmp port (fd=9)
Mar 27 17:43:23 bob racoon: INFO: 192.168.5.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used as isakmp port (fd=10)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used as isakmp port (fd=11)
Mar 27 17:43:23 bob racoon: INFO: 10.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=12)
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=13)
Mar 27 17:43:23 bob racoon: INFO: 127.0.0.1[4500] used for NAT-T
Mar 27 17:43:23 bob racoon: INFO: ::1[500] used as isakmp port (fd=18)
Mar 27 17:43:23 bob racoon: INFO: ::1[4500] used as isakmp port (fd=19)  

/etc/init.d/racoon start

client syslog
---------------
Mar 27 13:41:24 kyle racoon: INFO: @(#)ipsec-tools 0.6.6 (http://ipsec-tools.sourceforge.net)
Mar 27 13:41:24 kyle racoon: INFO: @(#)This product linked OpenSSL 0.9.8e 23 Feb 2007 (http://www.openssl.org/)
Mar 27 13:41:24 kyle racoon: NOTIFY: NAT-T is enabled, autoconfiguring ports
Mar 27 13:41:24 kyle racoon: INFO: 192.190.2.109[500] used as isakmp port (fd=7)
Mar 27 13:41:24 kyle racoon: INFO: 192.190.2.109[500] used for NAT-T
Mar 27 13:41:24 kyle racoon: INFO: 192.190.2.109[4500] used as isakmp port (fd=8)
Mar 27 13:41:24 kyle racoon: INFO: 192.190.2.109[4500] used for NAT-T
Mar 27 13:41:24 kyle racoon: INFO: 127.0.0.1[500] used as isakmp port (fd=9)
Mar 27 13:41:24 kyle racoon: INFO: 127.0.0.1[500] used for NAT-T
Mar 27 13:41:24 kyle racoon: INFO: 127.0.0.1[4500] used as isakmp port (fd=10)
Mar 27 13:41:24 kyle racoon: INFO: 127.0.0.1[4500] used for NAT-T