# Racoon IKE daemon configuration file.
# See 'man racoon.conf' for a description of the format and entries.

path certificate "/usr/local/etc/racoon/certs";

remote anonymous
{
        exchange_mode main;
        my_identifier fqdn "ipsec1.hack.org";
        # Other node:
        # my_identifier fqdn "ipsec2.hack.org";

	certificate_type plain_rsa "ipsec1.rsa";
        
        # NB! This usally means to lookup the older CERT records from DNS.
        # In my patches this will instead lookup IPSECKEY records. See:
        #  http://hack.org/mc/hacks/ipsec/
	peers_certfile dnssec;

        # We don't actually have any certificates so we can't verify them.
	verify_cert off;

        # Automatically generate a policy if we're not the initiator.
	generate_policy on;

        proposal
        {
                encryption_algorithm aes;
                hash_algorithm sha256;
                authentication_method rsasig;
                dh_group 2;
        }
}

sainfo anonymous
{
         lifetime time 1 hour;
         encryption_algorithm aes;
         authentication_algorithm hmac_sha256;
         compression_algorithm deflate;
}
