Appendix G - IPSEC
User Guide
399
Conn Parameters: Automatic Keying
The following parameters are relevant only to automatic keying, and are ignored in manual
keying. Unless otherwise noted, for a connection to work, in general it is necessary for the
two ends to agree exactly on the values of these parameters.
type
The type of the connection. Currently the accepted values are:
tunnel
(the default) signifying a host-to-host, host-to-subnet, or subnet-to-
subnet tunnel;
transport
, signifying host-to-host transport mode; and
passthrough
(supported only for manual keying), signifying that no IPsec
processing should be done at all.
left
Required. The IP address of the left participant's public-network interface.
If it is the magic value
%defaultroute
, and
interfaces=%defaultroute
is
used in the
config setup
section,
left
will be filled in automatically with
the local address of the default-route interface (as determined at IPsec star-
tup time). This also overrides any value supplied for
leftnexthop
. (Either
left
or
right
may be
%defaultroute
, but not both.) The magic value
%any
signifies an address to be filled in (by automatic keying) during negotia-
tion; the magic value
%opportunistic
signifies that both left and left-
nexthop are to be filled in (by automatic keying) from DNS data for left's
client.
leftsubnet
Private subnet behind the left participant, expressed as
network
/
netmask.
If omitted, essentially assumed to be
left
/
32
, signifying that the
left end of the connection goes to the left participant only.
leftnexthop
Next-hop gateway IP address for the left participant's connection to the
public network. Defaults to %direct (meaning
right
).
leftupdown
What
updown
script to run to adjust routing and/or firewalling when the
status of the connection changes.
