Appendix G - IPSEC
398
BLACK BOX
®
Advanced Console Server
Conn Sections
A
conn
section contains a
connection specification
, defining a network connection to be
made using IPsec. The name given is arbitrary, and is used to identify the connection to
ipsec_auto and ipsec_manual. Here's a simple example:
conn snt
left=10.11.11.1
leftsubnet=10.0.1.0/24
leftnexthop=172.16.55.66
right=192.168.22.1
rightsubnet=10.0.2.0/24
rightnexthop=172.16.88.99
keyingtries=0
# be very persistent
To avoid trivial editing of the configuration file to suit it to each system involved in a connec-
tion, connection specifications are written in terms of
left
and
right
participants, rather than
in terms of local and remote. Which participant is considered
left
or
right
is arbitrary; IPsec
figures out which one it is being run on based on internal information. This permits using
identical connection specifications on both ends.
Many of the parameters relate to one participant or the other; only the ones for
left
are listed
here, but every parameter whose name begins with left has a right counterpart, whose
description is the same but with left and right reversed.
Parameters are optional unless marked
required
; a parameter required for manual keying
need not be included for a connection which will use only automatic keying, and vice versa.
Conn Parameters
:
General
The following parameters are relevant to both automatic and manual keying. Unless other-
wise noted, for a connection to work, in general it is necessary for the two ends to agree
exactly on the values of these parameters.
