version 2.0 # conforms to second version of ipsec.conf specification config setup

# basic configuration
config setup
	# plutodebug / klipsdebug = "all", "none" or a combation from below:
	# "raw crypt parsing emitting control klips pfkey natt x509 private"
	# eg: plutodebug="control parsing"
	#
	# ONLY enable plutodebug=all or klipsdebug=all if you are a developer !!
	#
	# NAT-TRAVERSAL support, see README.NAT-Traversal
	plutodebug="control"
	charonstart=no
	plutostart=yes
	nat_traversal=yes
	interfaces=%defaultroute
	virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12
	uniqueids=no

conn %default
	keyingtries=3
	compress=no
	#lifetime=28000s
	#ikelifetime=60m
        ikelifetime=24h
        keylife=8h

conn roadwarrior
	keyexchange=ikev1
	leftprotoport=17/1701
	rightprotoport=17/%any
	rekey=no
	reauth=yes
	authby=secret
	pfs=no
	type=tunnel
	dpdaction=clear
	dpddelay=30
	dpdtimeout=60
	right=%any
	rightsubnet=vhost:%no,%priv
	left=%defaultroute
	leftnexthop=%defaultroute
	auto=add

conn block 
    auto=ignore

conn private 
    auto=ignore

conn private-or-clear 
    auto=ignore

conn clear-or-private 
    auto=ignore

conn clear 
    auto=ignore

conn packetdefault 
    auto=ignore
