# ipsec.conf - strongSwan IPsec configuration file

# basic configuration

config setup
  charondebug="dmn 1, mgr 1, ike 1, chd 1, job 1, cfg 1, knl 1, net 1, asn 1, enc 1, lib 1, esp 1, tls 1"
  strictcrlpolicy=no
  nat_traversal=yes

ca servers
  auto=add

conn %default
  ikelifetime=60m
  keylife=20m
  rekeymargin=3m
  keyingtries=1
  keyexchange=ikev1
  auto=add

conn iphone-ios8-ike-v2
  ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
  esp=aes256-sha256,aes256-sha1,3des-sha1!
  keyexchange=ikev2
  rightauth=pubkey
  left=%defaultroute
  leftid=@xxxx
  leftsubnet=0.0.0.0/0
  leftfirewall=no
  leftcert=ios8.pem
  leftsendcert=always
  leftupdown=/usr/xxxx
  right=%any
  # rightsubnet=10.252.0.0/16
  rightsourceip=10.252.0.0/16
  rightsendcert=always
  # Require all subject fields to be matched by star
  # As well as CA's pull in
  rightid="C=IKEV2, ST=*, L=*, O=*, CN=*"
  eap_identity=%any
  fragmentation=yes
  auto=add
