Appendix G - IPSEC
User Guide
379
# Some will override this with auto=start
auto=add
Variables set here are:
Editing a connection description
A sample connection description is:
# sample tunnel
# The network here looks like:
# leftsubnet====left----leftnexthop......rightnexthop----
right====rightsubnet
# If left and right are on the same Ethernet, omit leftnexthop and
rightnexthop.
conn sample
keyingtries
How persistent to be in (re)keying negotiations (0 means very).
For testing, you might wish to set this to some small number, per-
haps even to 1, to avoid wasting resources on incorrectly set up
connections. In production, it is often set to zero (retry forever).
Keeping the connection up is what machine resources are for, so
if a connection is down you might as well waste resources retry-
ing rather than waste them by sitting idle. Of course some cau-
tion should be exercised with this, since it can waste network
resources as well.
authby=rsasig
Authenticate gateways using RSA signatures. This is the preferred
method and is what we will use in this section's examples. An
alternate method is to use shared secrets.
auto=add
Automatically add connections descriptions to Pluto's in-memory
database at startup. This is required before Pluto can recognize
incoming requests for that connection, so we suggest making it
the default here. To actually start negotiations for a given connec-
tion, you need auto=start. You could make that the default here
or leave auto=add as the default and override it where needed
with auto=start in individual connection descriptions.
