1.\" $OpenBSD: iked.conf.5,v 1.35 2014/08/27 10:28:57 reyk Exp $ 2.\" 3.\" Copyright (c) 2010 - 2014 Reyk Floeter <reyk@openbsd.org> 4.\" Copyright (c) 2004 Mathieu Sauve-Frankel All rights reserved. 5.\" 6.\" Permission to use, copy, modify, and distribute this software for any 7.\" purpose with or without fee is hereby granted, provided that the above 8.\" copyright notice and this permission notice appear in all copies. 9.\" 10.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17.\" 18.Dd $Mdocdate: August 27 2014 $ 19.Dt IKED.CONF 5 20.Os 21.Sh NAME 22.Nm iked.conf 23.Nd IKEv2 configuration file 24.Sh DESCRIPTION 25.Nm 26is the configuration file for 27.Xr iked 8 , 28the Internet Key Exchange version 2 (IKEv2) daemon for IPsec. 29IPsec itself is a pair of protocols: 30Encapsulating Security Payload (ESP), 31which provides integrity and confidentiality; 32and Authentication Header (AH), 33which provides integrity. 34The IPsec protocol itself is described in 35.Xr ipsec 4 . 36.Pp 37In its most basic form, a flow is established between hosts and/or 38networks, and then Security Associations (SA) are established, 39which detail how the desired protection will be achieved. 40IPsec uses flows to determine whether to apply security services to an 41IP packet or not. 42.Xr iked 8 43is used to set up flows and establish SAs automatically, 44by specifying 45.Sq ikev2 46policies in 47.Nm 48(see 49.Sx AUTOMATIC KEYING POLICIES , 50below). 51.Pp 52Alternative methods of setting up flows and SAs are also possible 53using manual keying or automatic keying using the older ISAKMP/Oakley 54a.k.a. IKEv1 protocol. 55Manual keying is not recommended, but can be convenient for quick 56setups and testing. 57See 58.Xr ipsec.conf 5 59and 60.Xr isakmpd 8 61for more information about manual keying and ISAKMP support. 62.Sh IKED.CONF FILE FORMAT 63.Nm 64is divided into three main sections: 65.Bl -tag -width xxxx 66.It Sy Macros 67User-defined variables may be defined and used later, simplifying the 68configuration file. 69.It Sy Global Configuration 70Global settings for 71.Xr iked 8 . 72.It Sy Automatic Keying Policies 73Policies to set up IPsec flows and SAs automatically. 74.El 75.Pp 76Lines beginning with 77.Sq # 78and empty lines are regarded as comments, 79and ignored. 80Lines may be split using the 81.Sq \e 82character. 83.Pp 84Argument names not beginning with a letter, digit, or underscore 85must be quoted. 86.Pp 87Addresses can be specified in CIDR notation (matching netblocks), 88as symbolic host names, interface names, or interface group names. 89.Pp 90Additional configuration files can be included with the 91.Ic include 92keyword, for example: 93.Bd -literal -offset indent 94include "/etc/macros.conf" 95.Ed 96.Sh MACROS 97Macros can be defined that will later be expanded in context. 98Macro names must start with a letter, digit, or underscore, 99and may contain any of those characters. 100Macro names may not be reserved words (for example 101.Ic flow , 102.Ic from , 103.Ic esp ) . 104Macros are not expanded inside quotes. 105.Pp 106For example: 107.Bd -literal -offset indent 108remote_gw = "192.168.3.12" 109ikev2 esp from 192.168.7.0/24 to 192.168.8.0/24 peer $remote_gw 110.Ed 111.Sh GLOBAL CONFIGURATION 112Here are the settings that can be set globally: 113.Bl -tag -width xxxx 114.It Ic set active 115Set 116.Xr iked 8 117to active mode. 118This is the default. 119.It Ic set passive 120Set 121.Xr iked 8 122to passive mode. 123In passive mode no packets are sent to peers and no connections are 124initiated by 125.Xr iked 8 . 126This option is used for setups using 127.Xr sasyncd 8 128and 129.Xr carp 4 130to provide redundancy. 131iked will run in passive mode until sasyncd has determined that the host 132is the master and can switch to active mode. 133.It Ic set couple 134Load the negotiated security associations (SAs) and flows into the kernel. 135This is the default. 136.It Ic set decouple 137Don't load the negotiated SAs and flows from the kernel. 138This mode is only useful for testing and debugging. 139.It Ic set ocsp Ar URL 140Enable OCSP and set the URL of the OCSP responder. 141Please note that the matching responder and issuer certificates 142have to be placed in 143.Pa /etc/iked/ocsp/responder.crt 144and 145.Pa /etc/iked/ocsp/issuer.crt . 146.It Ic user Ar name Ar password 147.Xr iked 8 148supports user-based authentication by tunneling the Extensible 149Authentication Protocol (EAP) over IKEv2. 150In its most basic form, the users will be authenticated against a 151local, integrated password database that is configured with the 152.Ic user 153lines in 154.Nm 155and the 156.Ar name 157and 158.Ar password 159arguments. 160Note that the password has to be specified in plain text which is 161required to support different challenge-based EAP methods like 162EAP-MD5 or EAP-MSCHAPv2. 163.El 164.Sh AUTOMATIC KEYING POLICIES 165This section is used to configure policies that will be used by 166.Xr iked 8 167to set up flows and SAs automatically. 168Some examples of setting up automatic keying: 169.Bd -literal -offset 3n 170# Set up a VPN: 171# First between the gateway machines 192.168.3.1 and 192.168.3.2 172# Second between the networks 10.1.1.0/24 and 10.1.2.0/24 173ikev2 esp from 192.168.3.1 to 192.168.3.2 174ikev2 esp from 10.1.1.0/24 to 10.1.2.0/24 peer 192.168.3.2 175.Ed 176.Pp 177For incoming connections from remote peers, the policies are evaluated 178in sequential order, from first to last. 179The last matching policy decides what action is taken; if no policy matches 180the connection, the default action is to ignore the connection attempt or 181to use the 182.Ar default 183policy, if set. 184Please also see the 185.Sx EXAMPLES 186section for a detailed example of the policy evaluation. 187.Pp 188The first time an IKEv2 connection matches a policy, an IKE SA is 189created; for subsequent packets the connection is identified by the 190IKEv2 parameters that are stored in the SA without evaluating any 191policies. 192After the connection is closed or times out, the IKE SA is 193automatically removed. 194.Pp 195The commands are as follows: 196.Bl -tag -width xxxx 197.It Xo 198.Ic ikev2 199.Op Ar name 200.Xc 201The mandatory 202.Ic ikev2 203keyword will identify an IKEv2 automatic keying policy. 204.Ar name 205is an optional arbitrary string identifying the policy. 206The name should only occur once in 207.Nm 208or any included files. 209If omitted, 210a name will be generated automatically for the policy. 211.It Op Ar eval 212The 213.Ar eval 214option modifies the policy evaluation for this policy. 215It can be one of 216.Ar quick , 217.Ar skip 218or 219.Ar default . 220If a new incoming connection matches a policy with the 221.Ar quick 222option set, that policy is considered the last matching policy, 223and evaluation of subsequent policies is skipped. 224The 225.Ar skip 226option will disable evaluation of this policy for incoming connections. 227The 228.Ar default 229option sets the default policy and should only be specified once. 230.It Op Ar mode 231.Ar mode 232specifies the IKEv2 mode to use: 233one of 234.Ar passive 235or 236.Ar active . 237When 238.Ar passive 239is specified, 240.Xr iked 8 241will not immediately start negotiation of this tunnel, but wait for an incoming 242request from the remote peer. 243When 244.Ar active 245is specified, negotiation will be started at once. 246If omitted, 247.Ar passive 248mode will be used. 249.It Ic ipcomp 250Enable optional support for 251.Xr ipcomp 4 , 252the IP Payload Compression protocol. 253.It Op Ar encap 254.Ar encap 255specifies the encapsulation protocol to be used. 256Possible protocols are 257.Ar esp 258and 259.Ar ah ; 260the default is 261.Ar esp . 262.\" .It Op Ar tmode 263.\" .Ar tmode 264.\" describes the encapsulation mode to be used. 265.\" Possible modes are 266.\" .Ar tunnel 267.\" and 268.\" .Ar transport ; 269.\" the default is 270.\" .Ar tunnel . 271.It Op Ar af 272This policy only applies to endpoints of the specified address family 273which can be either 274.Ar inet 275or 276.Ar inet6 . 277Note that this only matters for IKEv2 endpoints and does not 278restrict the traffic selectors to negotiate flows with different 279address families, e.g. IPv6 flows negotiated by IPv4 endpoints. 280.It Ic proto Ar protocol 281The optional 282.Ic proto 283parameter restricts the flow to a specific IP protocol. 284Common protocols are 285.Xr icmp 4 , 286.Xr tcp 4 , 287and 288.Xr udp 4 . 289For a list of all the protocol name to number mappings used by 290.Xr iked 8 , 291see the file 292.Pa /etc/protocols . 293.It Xo 294.Ic from Ar src 295.Op Ic port Ar sport 296.Op Pq Ar srcnat 297.Ic to Ar dst 298.Op Ic port Ar dport 299.Xc 300Specify one or more traffic selectors for this policy which will be 301used to negotiate the IPsec flows between the IKEv2 peers. 302During the negotiation, the peers may decide to narrow a flow to a 303subset of the configured traffic selector networks to match the 304policies on each side. 305.Pp 306Each traffic selector will apply for packets with source address 307.Ar src 308and destination address 309.Ar dst . 310The keyword 311.Ar any 312will match any address (i.e. 0.0.0.0/0). 313If the 314.Ar src 315argument specifies a fictional source ID, 316the 317.Ar srcnat 318parameter can be used to specify the actual source address. 319This can be used in outgoing NAT/BINAT scenarios as described below. 320.Pp 321The optional 322.Ic port 323modifiers restrict the traffic selectors to the specified ports. 324They are only valid in conjunction with the 325.Xr tcp 4 326and 327.Xr udp 4 328protocols. 329Ports can be specified by number or by name. 330For a list of all port name to number mappings used by 331.Xr ipsecctl 8 , 332see the file 333.Pa /etc/services . 334.It Ic local Ar localip Ic peer Ar remote 335The 336.Ic local 337parameter specifies the address or FQDN of the local endpoint. 338Unless the gateway is multi-homed or uses address aliases, 339this option is generally not needed. 340.Pp 341The 342.Ic peer 343parameter specifies the address or FQDN of the remote endpoint. 344For host-to-host connections where 345.Ar dst 346is identical to 347.Ar remote , 348this option is generally not needed as it will be set to 349.Ar dst 350automatically. 351If it is not specified or if the keyword 352.Ar any 353is given, the default peer is used. 354.It Xo 355.Ic ikesa 356.Ic auth Ar algorithm 357.Ic enc Ar algorithm 358.Ic prf Ar algorithm 359.Ic group Ar group 360.Xc 361These parameters define the mode and cryptographic transforms to be 362used for the IKE SA negotiation, also known as phase 1. 363The IKE SA will be used to authenticate the machines and to set up an 364encrypted channel for the IKEv2 protocol. 365.Pp 366Possible values for 367.Ic auth , 368.Ic enc , 369.Ic prf , 370.Ic group , 371and the default proposals are described below in 372.Sx CRYPTO TRANSFORMS . 373If omitted, 374.Xr iked 8 375will use the default proposals for the IKEv2 protocol. 376.It Xo 377.Ic childsa 378.Ic auth Ar algorithm 379.Ic enc Ar algorithm 380.Ic group Ar group 381.Xc 382These parameters define the cryptographic transforms to be used for 383the Child SA negotiation, also known as phase 2. 384Each Child SA will be used to negotiate the actual IPsec SAs. 385The initial Child SA is always negotiated with the initial IKEv2 key 386exchange; additional Child SAs may be negotiated with additional 387Child SA key exchanges for an established IKE SA. 388.Pp 389Possible values for 390.Ic auth , 391.Ic enc , 392.Ic group , 393and the default proposals are described below in 394.Sx CRYPTO TRANSFORMS . 395If omitted, 396.Xr iked 8 397will use the default proposals for the ESP or AH protocol. 398The 399.Ic group 400option will only be used to enable Perfect Forwarding Security (PFS) 401for additional Child SAs exchanges that are not part of the initial 402key exchange. 403.It Ic srcid Ar string Ic dstid Ar string 404.Ic srcid 405defines an ID of type 406.Dq FQDN , 407.Dq ASN1_DN , 408.Dq IPV4 , 409.Dq IPV6 , 410or 411.Dq UFQDN 412that will be used by 413.Xr iked 8 414as the identity of the local peer. 415If the argument is an email address (reyk@example.com), 416.Xr iked 8 417will use UFQDN as the ID type. 418The ASN1_DN type will be used if the string starts with a slash 419.Sq / 420(/C=DE/../CN=10.0.0.1/emailAddress=reyk@example.com). 421If the argument is an IPv4 address or a compressed IPv6 address, 422the ID types IPV4 or IPV6 will be used. 423Anything else is considered to be an FQDN. 424.Pp 425If 426.Ic srcid 427is omitted, 428the default is to use the hostname of the local machine, 429see 430.Xr hostname 1 431to set or print the hostname. 432.Pp 433.Ic dstid 434is similar to 435.Ic srcid , 436but instead specifies the ID to be used 437by the remote peer. 438.It Ic ikelifetime Ar time 439The optional 440.Ic ikelifetime 441parameter defines the IKE SA expiration timeout by the 442.Ar time 443SA was created. 444A zero value disables active IKE SA rekeying. 445This is the default. 446.It Ic lifetime Ar time Op Ic bytes Ar bytes 447The optional 448.Ic lifetime 449parameter defines the Child SA expiration timeout by the 450.Ar time 451SA was in use and by the number of 452.Ar bytes 453that were processed using the SA. 454Default values are 3 hours and 512 megabytes which means that SA will be 455rekeyed before reaching the time limit or 512 megabytes of data 456will pass through. 457Zero values disable rekeying. 458.Pp 459Several unit specifiers are recognized (ignoring case): 460.Ql m 461and 462.Ql h 463for minutes and hours, and 464.Ql K , 465.Ql M 466and 467.Ql G 468for kilo-, mega- and gigabytes accordingly. 469.Pp 470Please note that rekeying must happen at least several times a day as 471IPsec security heavily depends on the frequent key renewals. 472.It Op Ar ikeauth 473Specify the mode to mutually authenticate the peers. 474Non-psk modes will require to set up certificates and RSA public keys; 475see 476.Xr iked 8 477for more information. 478.Pp 479.Bl -tag -width $domain -compact -offset indent 480.It Ic eap Ar type 481Use EAP to authenticate the initiator. 482The only supported EAP 483.Ar type 484is currently 485.Ar MSCHAP-V2 . 486The responder will use RSA public key authentication. 487.It Ic psk Ar string 488Use a pre-shared key 489.Ar string 490or hex value (starting with 0x) for authentication. 491.It Ic rsa 492Use RSA public key authentication. 493This is the default mode if no option is specified. 494.El 495.It Ic config Ar option address 496Send one or more optional configuration payloads (CP) to the peer. 497The configuration 498.Ar option 499can be one of the following with the expected address format: 500.Pp 501.Bl -tag -width Ds -compact -offset indent 502.It Ic address Ar address 503Assign a static address on the internal network. 504.It Ic address Ar address/prefix 505Assign a dynamic address on the internal network. 506The address will be assigned from an address pool with the size specified by 507.Ar prefix . 508.It Ic netmask Ar netmask 509The IPv4 netmask of the internal network. 510.It Ic name-server Ar address 511The DNS server address within the internal network. 512.It Ic netbios-server Ar address 513The NetBIOS name server (WINS) within the internal network. 514This option is provided for compatibility with legacy clients. 515.It Ic dhcp-server Ar address 516The address of an internal DHCP server for further configuration. 517.It Ic protected-subnet Ar address/prefix 518The address of the protected subnet within the internal network. 519.It Ic access-server Ar address 520The address of an internal remote access server. 521.El 522.It Ic tag Ar string 523Add a 524.Xr pf 4 525tag to all packets of IPsec SAs created for this connection. 526This will allow matching packets for this connection by defining 527rules in 528.Xr pf.conf 5 529using the 530.Cm tagged 531keyword. 532.Pp 533The following variables can be used in tags to include information 534from the remote peer on runtime: 535.Pp 536.Bl -tag -width $domain -compact -offset indent 537.It Ar $id 538The 539.Ic dstid 540that was proposed by the remote peer to identify itself. 541It will be expanded to 542.Ar id-value , 543e.g.\& 544.Ar FQDN/foo.example.com . 545To limit the size of the derived tag, 546.Xr iked 8 547will extract the common name 548.Sq CN= 549from ASN1_DN IDs, for example 550.Ar ASN1_ID//C=DE/../CN=10.1.1.1/.. 551will be expanded to 552.Ar 10.1.1.1 . 553.It Ar $domain 554Extract the domain from IDs of type FQDN, UFQDN or ASN1_DN. 555.It Ar $name 556The name of the IKEv2 policy that was configured in 557.Nm 558or automatically generated by 559.Xr iked 8 . 560.El 561.Pp 562For example, if the ID is 563.Ar FQDN/foo.example.com 564or 565.Ar UFQDN/user@example.com , 566.Dq ipsec-$domain 567expands to 568.Dq ipsec-example.com . 569The variable expansion for the 570.Ar tag 571directive occurs only at runtime, not during configuration file parse time. 572.It Ic tap Ar interface 573Send the decapsulated IPsec traffic to the specified 574.Xr enc 4 575.Ar interface 576instead of 577.Ar enc0 578for filtering and monitoring. 579The traffic will be blocked if the specified 580.Ar interface 581does not exist. 582.El 583.Sh PACKET FILTERING 584IPsec traffic appears unencrypted on the 585.Xr enc 4 586interface 587and can be filtered accordingly using the 588.Ox 589packet filter, 590.Xr pf 4 . 591The grammar for the packet filter is described in 592.Xr pf.conf 5 . 593.Pp 594The following components are relevant to filtering IPsec traffic: 595.Bl -ohang -offset indent 596.It external interface 597Interface for IKE traffic and encapsulated IPsec traffic. 598.It proto udp port 500 599IKE traffic on the external interface. 600.It proto udp port 4500 601IKE NAT-Traversal traffic on the external interface. 602.It proto ah \*(Ba esp 603Encapsulated IPsec traffic 604on the external interface. 605.It enc0 606Default interface for outgoing traffic before it's been encapsulated, 607and incoming traffic after it's been decapsulated. 608State on this interface should be interface bound; 609see 610.Xr enc 4 611for further information. 612.It proto ipencap 613[tunnel mode only] 614IP-in-IP traffic flowing between gateways 615on the enc0 interface. 616.It tagged ipsec-example.org 617Match traffic of IPsec SAs using the 618.Ic tag 619keyword. 620.El 621.Pp 622If the filtering rules specify to block everything by default, 623the following rule 624would ensure that IPsec traffic never hits the packet filtering engine, 625and is therefore passed: 626.Bd -literal -offset indent 627set skip on enc0 628.Ed 629.Pp 630In the following example, all traffic is blocked by default. 631IPsec-related traffic from gateways {192.168.3.1, 192.168.3.2} and 632networks {10.0.1.0/24, 10.0.2.0/24} is permitted. 633.Bd -literal -offset indent 634block on ix0 635block on enc0 636 637pass in on ix0 proto udp from 192.168.3.2 to 192.168.3.1 \e 638 port {500, 4500} 639pass out on ix0 proto udp from 192.168.3.1 to 192.168.3.2 \e 640 port {500, 4500} 641 642pass in on ix0 proto esp from 192.168.3.2 to 192.168.3.1 643pass out on ix0 proto esp from 192.168.3.1 to 192.168.3.2 644 645pass in on enc0 proto ipencap from 192.168.3.2 to 192.168.3.1 \e 646 keep state (if-bound) 647pass out on enc0 proto ipencap from 192.168.3.1 to 192.168.3.2 \e 648 keep state (if-bound) 649pass in on enc0 from 10.0.2.0/24 to 10.0.1.0/24 \e 650 keep state (if-bound) 651pass out on enc0 from 10.0.1.0/24 to 10.0.2.0/24 \e 652 keep state (if-bound) 653.Ed 654.Pp 655.Xr pf 4 656has the ability to filter IPsec-related packets 657based on an arbitrary 658.Em tag 659specified within a ruleset. 660The tag is used as an internal marker 661which can be used to identify the packets later on. 662This could be helpful, 663for example, 664in scenarios where users are connecting in from differing IP addresses, 665or to support queue-based bandwidth control, 666since the enc0 interface does not support it. 667.Pp 668The following 669.Xr pf.conf 5 670fragment uses queues for all IPsec traffic with special 671handling for developers and employees: 672.Bd -literal -offset indent 673queue std on ix0 bandwidth 100M 674queue deflt parent std bandwidth 10M default 675queue developers parent std bandwidth 75M 676queue employees parent std bandwidth 5M 677queue ipsec parent std bandwidth 10M 678 679pass out on ix0 proto esp set queue ipsec 680 681pass out on ix0 tagged ipsec-developers.example.com set queue developers 682pass out on ix0 tagged ipsec-employees.example.com set queue employees 683.Ed 684.Pp 685The following example assigns the tags in the 686.Nm 687configuration and also sets an alternative 688.Xr enc 4 689device: 690.Bd -literal -offset indent 691ikev2 esp from 10.1.1.0/24 to 10.1.2.0/24 peer 192.168.3.2 \e 692 tag ipsec-$domain tap "enc1" 693.Ed 694.Sh OUTGOING NETWORK ADDRESS TRANSLATION 695In some network topologies it is desirable to perform NAT on traffic leaving 696through the VPN tunnel. 697In order to achieve that, 698the 699.Ar src 700argument is used to negotiate the desired network ID with the peer 701and the 702.Ar srcnat 703parameter defines the true local subnet, 704so that a correct SA can be installed on the local side. 705.Pp 706For example, 707if the local subnet is 192.168.1.0/24 and all the traffic 708for a specific VPN peer should appear as coming from 10.10.10.1, 709the following configuration is used: 710.Bd -literal -offset indent 711ikev2 esp from 10.10.10.1 (192.168.1.0/24) to 192.168.2.0/24 \e 712 peer 10.10.20.1 713.Ed 714.Pp 715Naturally, 716a relevant NAT rule is required in 717.Xr pf.conf 5 . 718For the example above, 719this would be: 720.Bd -literal -offset indent 721match out on enc0 from 192.168.1.0/24 to 192.168.2.0/24 nat-to 10.10.10.1 722.Ed 723.Pp 724From the peer's point of view, 725the local end of the VPN tunnel is declared to be 10.10.10.1 726and all the traffic arrives with that source address. 727.Sh CRYPTO TRANSFORMS 728The following authentication types are permitted with the 729.Ic auth 730keyword: 731.Bl -column "Authentication" "Key Length" "Truncated Length" -offset indent 732.It Em "Authentication" Ta Em "Key Length" Ta Em "Truncated Length" 733.It Li hmac-md5 Ta "128 bits" Ta "96 bits" 734.It Li hmac-sha1 Ta "160 bits" Ta "96 bits" 735.It Li hmac-sha2-256 Ta "256 bits" Ta "128 bits" 736.It Li hmac-sha2-384 Ta "384 bits" Ta "192 bits" 737.It Li hmac-sha2-512 Ta "512 bits" Ta "256 bits" 738.El 739.Pp 740The following pseudo-random function types are permitted with the 741.Ic prf 742keyword: 743.Bl -column "Authentication" "Key Length" "[IKE only]" -offset indent 744.It Em "Authentication" Ta Em "Key Length" Ta "" 745.It Li hmac-md5 Ta "128 bits" Ta "[IKE only]" 746.It Li hmac-sha1 Ta "160 bits" Ta "[IKE only]" 747.It Li hmac-sha2-256 Ta "256 bits" Ta "[IKE only]" 748.It Li hmac-sha2-384 Ta "384 bits" Ta "[IKE only]" 749.It Li hmac-sha2-512 Ta "512 bits" Ta "[IKE only]" 750.El 751.Pp 752The following cipher types are permitted with the 753.Ic enc 754keyword: 755.Bl -column "aes-128-gmac" "Key Length" "[ESP only]" -offset indent 756.It Em "Cipher" Ta Em "Key Length" Ta "" 757.It Li des Ta "56 bits" Ta "[ESP only]" 758.It Li 3des Ta "168 bits" Ta "" 759.It Li aes-128 Ta "128 bits" Ta "" 760.It Li aes-192 Ta "192 bits" Ta "" 761.It Li aes-256 Ta "256 bits" Ta "" 762.It Li aes-128-ctr Ta "160 bits" Ta "[ESP only]" 763.It Li aes-192-ctr Ta "224 bits" Ta "[ESP only]" 764.It Li aes-256-ctr Ta "288 bits" Ta "[ESP only]" 765.It Li aes-128-gcm Ta "160 bits" Ta "[ESP only]" 766.It Li aes-192-gcm Ta "224 bits" Ta "[ESP only]" 767.It Li aes-256-gcm Ta "288 bits" Ta "[ESP only]" 768.It Li blowfish Ta "160 bits" Ta "[ESP only]" 769.It Li cast Ta "128 bits" Ta "[ESP only]" 770.El 771.Pp 772The following cipher types provide only authentication, 773not encryption: 774.Bl -column "aes-128-gmac" "Key Length" "[ESP only]" -offset indent 775.It Li aes-128-gmac Ta "160 bits" Ta "[ESP only]" 776.It Li aes-192-gmac Ta "224 bits" Ta "[ESP only]" 777.It Li aes-256-gmac Ta "288 bits" Ta "[ESP only]" 778.It Li null Ta "" Ta "[ESP only]" 779.El 780.Pp 781Use of DES as an encryption algorithm is not recommended (except for 782backwards compatibility) due to the short key length. 783.Pp 784DES requires 8 bytes to form a 56-bit key and 3DES requires 24 bytes 785to form its 168-bit key. 786This is because the most significant bit of each byte is used for parity. 787.Pp 788The keysize of AES-CTR is actually 128-bit. 789However as well as the key, a 32-bit nonce has to be supplied. 790Thus 160 bits of key material have to be supplied. 791The same applies to AES-GCM and AES-GMAC. 792.Pp 793Using AES-GMAC or NULL with ESP will only provide authentication. 794This is useful in setups where AH can not be used, e.g. when NAT is involved. 795.Pp 796The following group types are permitted with the 797.Ic group 798keyword: 799.Bl -column "modp1024-160" "Group" "Size" "Type" -offset indent 800.It Em Name Ta Em Group Ta Em Size Ta Em Type 801.It Li modp768 Ta grp1 Ta 768 Ta "MODP" 802.It Li modp1024 Ta grp2 Ta 1024 Ta "MODP" 803.It Li ec2n155 Ta grp3 Ta 155 Ta "EC2N [insecure]" 804.It Li ec2n185 Ta grp4 Ta 185 Ta "EC2N [insecure]" 805.It Li modp1536 Ta grp5 Ta 1536 Ta "MODP" 806.It Li modp2048 Ta grp14 Ta 2048 Ta "MODP" 807.It Li modp3072 Ta grp15 Ta 3072 Ta "MODP" 808.It Li modp4096 Ta grp16 Ta 4096 Ta "MODP" 809.It Li modp6144 Ta grp17 Ta 6144 Ta "MODP" 810.It Li modp8192 Ta grp18 Ta 8192 Ta "MODP" 811.It Li ecp256 Ta grp19 Ta 256 Ta "ECP" 812.It Li ecp384 Ta grp20 Ta 384 Ta "ECP" 813.It Li ecp521 Ta grp21 Ta 521 Ta "ECP" 814.It Li modp1024-160 Ta grp22 Ta 2048 Ta "MODP, 160 bit Prime Order Subgroup" 815.It Li modp2048-224 Ta grp23 Ta 2048 Ta "MODP, 224 bit Prime Order Subgroup" 816.It Li modp2048-256 Ta grp24 Ta 2048 Ta "MODP, 256 bit Prime Order Subgroup" 817.It Li ecp192 Ta grp25 Ta 192 Ta "ECP" 818.It Li ecp224 Ta grp26 Ta 224 Ta "ECP" 819.It Li brainpool224 Ta grp27 Ta 224 Ta "ECP, brainpoolP224r1" 820.It Li brainpool256 Ta grp28 Ta 256 Ta "ECP, brainpoolP256r1" 821.It Li brainpool384 Ta grp29 Ta 384 Ta "ECP, brainpoolP384r1" 822.It Li brainpool512 Ta grp30 Ta 512 Ta "ECP, brainpoolP512r1" 823.It Li curve25519 Ta - Ta 256 Ta "Curve25519" 824.El 825.Pp 826The currently supported group types are either 827MODP (exponentiation groups modulo a prime), 828EC2N (elliptic curve groups over GF[2^N]), 829ECP (elliptic curve groups modulo a prime), 830or the non-standard Curve25519. 831Please note that the EC2N groups are considered as insecure and only 832provided for backwards compatibility. 833.Sh EXAMPLES 834The first example is intended for clients connecting to 835.Xr iked 8 836as an IPsec gateway, or IKEv2 responder, using mutual public key 837authentication and additional challenge-based EAP-MSCHAPv2 password 838authentication: 839.Bd -literal -offset indent 840user "test" "password123" 841 842ikev2 "win7" esp \e 843 from 0.0.0.0/0 to 172.16.2.0/24 \e 844 peer 10.0.0.0/8 local 192.168.56.0/24 \e 845 eap "mschap-v2" \e 846 config address 172.16.2.1 \e 847 tag "$name-$id" 848.Ed 849.Pp 850The next example allows peers to authenticate using a pre-shared key 851.Sq foobar : 852.Bd -literal -offset indent 853ikev2 "big test" \e 854 esp proto tcp \e 855 from 10.0.0.0/8 port 23 to 20.0.0.0/8 port 40 \e 856 from 192.168.1.1 to 192.168.2.2 \e 857 peer any local any \e 858 ikesa enc 3des auth hmac-sha1 group modp1024 \e 859 childsa enc aes-128 auth hmac-sha1 \e 860 srcid host.example.com \e 861 dstid 192.168.0.254 \e 862 psk "foobar" 863.Ed 864.Pp 865The following example illustrates the last matching policy 866evaluation for incoming connections on an IKEv2 gateway. 867The peer 192.168.1.34 will always match the first policy because of the 868.Ar quick 869keyword; 870connections from the peers 192.168.1.3 and 192.168.1.2 will be matched 871by one of the last two policies; 872any other connections from 192.168.1.0/24 will be matched by the 873.Sq subnet 874policy; 875and any other connection will be matched by the 876.Sq catch all 877policy. 878.Bd -literal -offset indent 879ikev2 quick esp from 10.10.10.0/24 to 10.20.20.0/24 \e 880 peer 192.168.1.34 881ikev2 "catch all" esp from 10.0.1.0/24 to 10.0.2.0/24 \e 882 peer any 883ikev2 "subnet" esp from 10.0.3.0/24 to 10.0.4.0/24 \e 884 peer 192.168.1.0/24 885ikev2 esp from 10.0.5.0/30 to 10.0.5.4/30 peer 192.168.1.2 886ikev2 esp from 10.0.5.8/30 to 10.0.5.12/30 peer 192.168.1.3 887.Ed 888.Sh SEE ALSO 889.Xr enc 4 , 890.Xr ipsec 4 , 891.Xr ipsec.conf 5 , 892.Xr pf.conf 5 , 893.Xr ikectl 8 , 894.Xr iked 8 895.Sh HISTORY 896The 897.Nm 898file format first appeared in 899.Ox 4.8 . 900.Sh AUTHORS 901The 902.Xr iked 8 903program was written by 904.An Reyk Floeter Aq Mt reyk@openbsd.org . 905