Appendix G - IPSEC
378
BLACK BOX
®
Advanced Console Server
Connection defaults
There is a special name %default that lets you define things that apply to all connections. You
can also set general defaults here and override them later for specific connections. If both the
%default section and the actual connection description set the same variable, then the con-
nection description takes precedence.
Our example file has:
# defaults for subsequent connection descriptions
conn %default
# How persistent to be in (re)keying negotiations (0 means very).
keyingtries=0
# How to authenticate gateways
authby=rsasig
# Load all connection descriptions by default
plutostart
List of connections to be automatically negotiated when Pluto
starts. plutoload and plutostart can be quoted lists of connection
names, but are often set to %search as in our example. Any con-
nection with auto=add in its connection definition is then
loaded, and any connection with auto=start is started. In most
cases, you want plutostart=%search here and auto=start in your
connection descriptions. That way when a connection is broken,
for example if one machine crashes or is taken down for some
reason, it will be reliably rebuilt. If only one end is told to start
the connection, and then the other end crashes, you may lose
the connection for a long time. The end that could rebuild does
not know what it needs to.
uniqueids
Controls whether two connections with the same subnet on the
remote end are allowed. Normally this is set to
yes
so that when a
remote system disconnects and reconnects, Pluto will
automatically take the old connection down.
