# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
	#plutodebug=control
	# crlcheckinterval=600
	# strictcrlpolicy=yes
	# cachecrls=yes
	# nat_traversal=yes
	# charonstart=no
	plutostart=no

# Add connections here.

conn %default
	ikelifetime=60m
	keylife=20m
	rekeymargin=3m
	keyingtries=1
	mobike=no
	# PSK
	#authby=secret
	# ECDSA
	authby=ecdsasig
	keyexchange=ikev2
	
	# gcm256
	ike=aes256-sha384-modp2048!
	esp=aes256gcm16-modp1024-modp2048!
	
	# gcm128
	#ike=aes128-sha256-modp2048!
        #esp=aes128gcm16-modp1024-modp2048!
	
	# gmac128
	#ike=aes128-sha256-modp2048!
	#esp=aes128gmac-modp2048!
	
	# gmac256
	#ike=aes256-sha384-modp2048!
	#esp=aes256gmac-modp2048!
	
	# null encryption with sha1
	#esp=null-sha1
	
	#esp=aes-aesxcbc-modp2048!

conn testipsec
	type=transport 
	left=10.168.80.8
	leftprotoport=tcp/%any
	leftcert=testPub.der
	#leftid=kap
	right=10.168.65.1
	rightprotoport=tcp/%any
	#rightid=cep
	auto=route
