# /etc/ipsec.conf - Openswan IPsec configuration file
# RCSID $Id: ipsec.conf.in,v 1.15.2.4 2006/07/11 16:17:53 paul Exp $

# This file:  /usr/share/doc/openswan/ipsec.conf-sample
#
# Manual:     ipsec.conf.5


version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
        # plutodebug / klipsdebug = "all", "none" or a combation from below:
        # "raw crypt parsing emitting control klips pfkey natt x509 private"
        # eg:
        # plutodebug="control parsing"
        #
        # Only enable klipsdebug=all if you are a developer
        #
        # NAT-TRAVERSAL support, see README.NAT-Traversal
        # nat_traversal=yes
        # virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
        #
        # enable this if you see "failed to find any available worker"
        nhelpers=0
        interfaces="ipsec0=eth1:0"
        klipsdebug=none
        plutodebug=none
        uniqueids=yes


# Add connections here
conn %default
        keyingtries=0
        disablearrivalcheck=no
        authby=rsasig
        leftrsasigkey=%dns
        rightrsasigkey=%dns


#
# VPN Connection to east
#
conn east1
    also=east
    rightsubnet=10.8.160.0/19
    auto=start

conn east2
    also=east
    rightsubnet=10.18.249.0/24
    auto=start

conn east
     type=tunnel
     authby=secret
     # compress=no
     # west
     left=west.public.ip.addr
     leftsubnet=10.8.158.0/24
     leftnexthop=west.router.ip.addr
     # east
     rightid=10.8.15.99
     right=east.public.ip.addr
     auth=esp
     keyexchange=ike
     pfs=no
     # 8h
     ikelifetime=28800s
     # 24h
     keylife=86400s
     # esp=aes256-sha1-160
     esp=aes
     # auto=start

#Disable Opportunistic Encryption
include /etc/ipsec.d/examples/no_oe.conf