# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
	# strictcrlpolicy=yes
	uniqueids = never
	# plutostart = no

conn %default
	ikelifetime=3h
	keylife=1h
	rekeymargin=3m
	keyingtries=3
	keyexchange=ikev1
	ike=aes256-sha-modp1024
	esp=aes256-sha
	authby=secret
	dpdaction=restart
	dpddelay=10s
	dpdtimeout=60s

conn common
	left=%defaultroute
	leftsubnet=10.240.45.0/24
	leftid=@customer.domain.com
	#leftfirewall=yes
	right=xx.xx.xx.13
	rightid=xx.xx.xx.13

conn trust
	also=common
	rightsubnet=yy.yy.yy.32/28
	auto=start

conn dmz
	also=common
	rightsubnet=yy.yy.yy.48/28
	auto=start
