1.\" $OpenBSD: isakmpd.conf.5,v 1.139 2023/08/08 10:31:03 dlg Exp $ 2.\" $EOM: isakmpd.conf.5,v 1.57 2000/12/21 14:43:17 ho Exp $ 3.\" 4.\" Copyright (c) 1998, 1999, 2000 Niklas Hallqvist. All rights reserved. 5.\" Copyright (c) 2000, 2001, 2002 H�kan Olsson. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 17.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 18.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 19.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 20.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 21.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 22.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 23.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 24.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 25.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 26.\" 27.\" This code was written under funding by Ericsson Radio Systems. 28.\" 29.\" Manual page, using -mandoc macros 30.\" 31.Dd $Mdocdate: August 8 2023 $ 32.Dt ISAKMPD.CONF 5 33.Os 34.Sh NAME 35.Nm isakmpd.conf 36.Nd configuration file for isakmpd 37.Sh DESCRIPTION 38.Nm 39is the configuration file for the 40.Xr isakmpd 8 41daemon, managing security association and key management for the 42IPsec layer of the kernel's networking stack. 43.Pp 44The file is of a well-known type of format called .INI style, named after 45the suffix used by an overrated windowing environment for its configuration 46files. 47This format consists of sections, each beginning with a line looking like: 48.Bd -unfilled 49.Bq Sy Section name 50.Ed 51Between the brackets is the name of the section following this section header. 52Inside a section many tag/value pairs can be stored, each one looking like: 53.Bd -unfilled 54.Ar Tag Ns = Ns Ar Value 55.Ed 56The current line can be extended over multiple lines using a backslash 57.Pq Sq \e . 58Comments can be put anywhere in the file using a hash mark 59.Pq Sq # , 60and extend to the end of the current line. 61Care should be taken when commenting out multi-line text: 62the comment remains in effect until the end of the entire current line. 63.Pp 64Often the right-hand side values consist of other section names. 65This results in a tree structure. 66Some values are treated as a list of several scalar values. 67Such lists always use a comma character as the separator. 68Some values are formatted like this: X,Y:Z, which 69is an offer/accept syntax, where X is a value we offer and Y:Z is a range of 70accepted values, inclusive. 71.Pp 72To activate changes to 73.Nm 74without restarting 75.Xr isakmpd 8 , 76send a 77.Dv SIGHUP 78signal to the daemon process. 79.Sh AUTO-GENERATED PARTS OF THE CONFIGURATION 80Some predefined section names are recognized by the daemon, avoiding the need 81to fully specify the Main Mode transforms and Quick Mode suites, protocols, 82and transforms. 83.Pp 84For Main Mode: 85.\" cipher-hash[-group][-RSA_SIG] 86.Bl -inset -compact 87.It Xo 88.Sm off 89.Ar cipher No - Ar hash 90.Op - Ar group 91.Op -RSA_SIG 92.Sm on 93.Xc 94.El 95.Pp 96where: 97.Bl -tag -width "cipher" -offset indent -compact 98.It Ar cipher 99is either BLF, 3DES, CAST, AES, AES-128, AES-192 or AES-256 100.It Ar hash 101is either MD5, SHA, or SHA2-{256,384,512} 102.It Ar group 103is either GRP1, GRP2, GRP5, GRP14, GRP15, GRP16, GRP17, GRP18, 104GRP19, GRP20, GRP21, GRP25, GRP26, GRP27, GRP28, GRP29 or GRP30. 105.El 106.Pp 107For Quick Mode: 108.\" QM-proto[-TRP]-cipher[-hash][-PFS[-group]]-SUITE 109.Bl -inset -compact 110.It Xo 111.Sm off 112.No QM- Ar proto Op -TRP 113.No - Ar cipher Op - Ar hash 114.Op -PFS Op - Ar group 115.No -SUITE 116.Sm on 117.Xc 118.El 119.Pp 120where: 121.Bl -tag -width "cipher" -offset indent -compact 122.It Ar proto 123is either ESP or AH 124.It Ar cipher 125is either 3DES, CAST, BLF, AES, AES-128, AES-192, AES-256, AESCTR, 126AESCTR-128, AESCTR-192, AESCTR-256, 127AESGCM-128, AESGCM-192, AESGCM-256, AESGMAC-128, AESGMAC-192, AESGMAC-256 128or NULL 129.It Ar hash 130is either MD5, SHA, RIPEMD, or SHA2-{256,384,512} 131.It Ar group 132is either GRP1, GRP2, GRP5, GRP14, GRP15, GRP16, GRP17, GRP18, 133GRP19, GRP20, GRP21, GRP25, GRP26, GRP27, GRP28, GRP29 or GRP30. 134.El 135.Pp 136For example, AES-SHA2-256 means: AES encryption, SHA2-256 hash, and 137authorization by pre-shared keys. 138Adding "-RSA_SIG" will enable public key authentication, 139e.g. AES-SHA2-256-RSA_SIG. 140Similarly, QM-ESP-3DES-SHA-PFS-SUITE means: ESP protocol, 3DES encryption, 141SHA hash, and use Perfect Forward Secrecy. 142.Pp 143Unless explicitly stated with -GRP1, 2, 5, 14, 15, 16, 17, 18, 19, 20, 21, 14425, 26, 27, 28, 29 or 30, transforms and PFS suites use DH group 2. 145There are currently no predefined ESP+AH Quick Mode suites. 146.Pp 147The predefinitions include some default values for the special 148sections "General", "Keynote", "X509-certificates", and 149"Default-phase-1-configuration". 150These default values are presented in the example below. 151.Pp 152All autogenerated values can be overridden by manual entries by using the 153same section and tag names in the configuration file. 154In particular, the default phase 1 (Main or Aggressive Mode) and phase 2 155(Quick Mode) lifetimes can be overridden by these tags under the "General" 156section: 157.Bd -literal -offset indent 158[General] 159Default-phase-1-lifetime= 3600,60:86400 160Default-phase-2-lifetime= 1200,60:86400 161.Ed 162.Pp 163The Main Mode lifetime currently defaults to one hour (minimum 60 164seconds, maximum 1 day). 165The Quick Mode lifetime defaults to 20 minutes 166(minimum 60 seconds, maximum 1 day). 167.Pp 168Also, the default phase 1 ID can be set by creating a 169.Aq Sy Phase1-ID 170section, as shown below, and adding this tag under the "General" 171section: 172.Bd -literal -offset indent 173[General] 174Default-phase-1-ID= Phase1-ID-name 175 176[Phase1-ID-name] 177ID-type= USER_FQDN 178Name= foo@bar.com 179.Ed 180.Sh ROOTS 181.Bl -hang -width 8n 182.It Bq Sy General 183Generic global configuration parameters 184.Bl -tag -width Ds 185.It Em Acquire-Only 186If this tag is defined, 187.Xr isakmpd 8 188will not set up flows automatically. 189This is useful when flows are configured with 190.Xr ipsecctl 8 191or by other programs like 192.Xr bgpd 8 . 193Thus 194.Xr isakmpd 8 195only takes care of the SA establishment. 196.It Em Check-interval 197The interval between watchdog checks of connections we want up at all 198times, in seconds. 199The default value is 60 seconds. 200.It Em Default-phase-1-ID 201Optional default phase 1 ID name. 202.It Em Default-phase-1-lifetime 203The default lifetime for autogenerated transforms (phase 1). 204If unspecified, the value 3600,60:86400 is used as the default. 205.It Em Default-phase-2-lifetime 206The default lifetime for autogenerated suites (phase 2). 207If unspecified, the value 1200,60:86400 is used as the default. 208.It Em Default-phase-2-suites 209A list of phase 2 suites that will be used when establishing dynamic 210SAs. 211If left unspecified, QM-ESP-3DES-SHA-PFS-SUITE is used as the default. 212.It Em DPD-check-interval 213The interval between RFC 3706 (Dead Peer Detection) messages, in seconds. 214The default value is 0 (zero), which means DPD is disabled. 215.It Em Exchange-max-time 216How many seconds should an exchange maximally take to set up before we 217give up. 218.It Em Listen-on 219A list of IP addresses or interface names OK to listen on. 220This list is used as a filter for the set of addresses the interfaces 221configured provides. 222This means that we won't see if an address given here does not exist 223on this host, and thus no error is given for that case. 224On multi-homed systems, this parameter can be used to enforce the 225use of particular source IP addresses in packets sent by 226.Xr isakmpd 8 . 227.It Em Loglevel 228A list of the form 229.Ar class Ns = Ns Ar level , 230where both 231.Ar class 232and 233.Ar level 234are numbers. 235This is similar to the 236.Fl D 237command line switch of 238.Xr isakmpd 8 . 239.It Em Logverbose 240If this tag is defined, whatever the value is, verbose logging is enabled. 241This is similar to the 242.Fl v 243command line switch of 244.Xr isakmpd 8 . 245.It Em NAT-T-Keepalive 246The number of seconds between NAT-T keepalive messages, sent by the 247peer behind NAT to keep the mapping active. 248Defaults to 20. 249.It Em Policy-file 250The name of the file that contains 251.Xr keynote 4 252policies. 253The default is 254.Pa /etc/isakmpd/isakmpd.policy . 255.It Em Pubkey-directory 256The directory in which 257.Nm 258looks for explicitly trusted public keys. 259The default is 260.Pa /etc/isakmpd/pubkeys . 261Read 262.Xr isakmpd 8 263for the required naming convention of the files in here. 264.It Em Renegotiate-on-HUP 265If this tag is defined, whatever the value is, 266.Xr isakmpd 8 267will renegotiate all current phase 2 SAs when the daemon receives a 268.Dv SIGHUP 269signal, or an 270.Sq R 271is sent to the FIFO interface (see 272.Xr isakmpd 8 ) . 273.It Em Retransmits 274How many times should a message be retransmitted before giving up. 275.It Em Shared-SADB 276If this tag is defined, whatever the value is, some semantics of 277.Nm 278are changed so that multiple instances can run on top of one SADB 279and set up SAs with each other. 280Specifically this means replay 281protection will not be asked for, and errors that can occur when 282updating an SA with its parameters a 2nd time will be ignored. 283.It Em Use-Keynote 284This tag controls the use of 285.Xr keynote 4 286policy checking. 287The default value is 288.Qq yes , 289which enables the policy checking. 290When set to any other value, policies will not be checked. 291This is useful when policies for flows and SA establishment are arranged by 292other programs like 293.Xr ipsecctl 8 294or 295.Xr bgpd 8 . 296.El 297.It Bq Sy Phase 1 298ISAKMP SA negotiation parameter root 299.Bl -tag -width Ds 300.It Em Default 301A name of the default ISAKMP peer. 302Incoming phase 1 connections from other IP addresses will use this peer name. 303This name is used as the section name for further information to be found. 304Look at 305.Aq Sy ISAKMP-peer 306below. 307.It Aq Em IP-address 308A name of the ISAKMP peer at the given IP address. 309.El 310.It Bq Sy Phase 2 311IPsec SA negotiation parameter root 312.Bl -tag -width Ds 313.It Em Connections 314A list of directed IPsec "connection" names that should be brought up 315automatically, either on first use if the system supports it, or at 316startup of the daemon. 317These names are section names where further information can be found. 318Look at 319.Aq Sy IPsec-connection 320below. 321Normally any connections mentioned here are treated as part of the 322"Passive-connection" list we present below; however there is a flag, 323.Em Active-only , 324that disables this behaviour. 325This too is mentioned in the 326.Aq Sy IPsec-connection 327section, in the "Flags" tag. 328.It Em Passive-connections 329A list of IPsec "connection" names we recognize and accept initiations for. 330These names are section names where further information can be found. 331Look at 332.Aq Sy IPsec-connection 333below. 334Currently only the Local-ID and Remote-ID tags 335are looked at in those sections, as they are matched against the IDs given 336by the initiator. 337.El 338.It Bq Sy KeyNote 339KeyNote configuration section 340.Bl -tag -width Ds 341.It Em Credential-directory 342A directory containing directories named after IDs (IP 343addresses, 344.Dq user@domain , 345or hostnames) that contain files named 346.Dq credentials 347and 348.Dq private_key . 349.Pp 350The credentials file contains 351.Xr keynote 4 352credentials that are sent to a remote IKE daemon when we use the 353associated ID, or credentials that we may want to consider when doing 354an exchange with a remote IKE daemon that uses that ID. 355Note that, in the former case, the last credential in the file 356MUST contain our public key in its Licensees field. 357More than one credentials may exist in the file. 358They are separated by whitelines (the format is essentially the same as 359that of the policy file). 360The credentials are of the same format as the policies described in 361.Xr isakmpd.policy 5 . 362The only difference is that the Authorizer field contains a public 363key, and the assertion is signed. 364Signed assertions can be generated using the 365.Xr keynote 1 366utility. 367.Pp 368The private_key file contains the private RSA key we use for 369authentication. 370If the directory (and the files) exist, they take precedence over X509-based 371authentication. 372.El 373.It Bq Sy X509-Certificates 374X509-certificate configuration section 375.Bl -tag -width Ds 376.It Em Accept-self-signed 377If this tag is defined, whatever the value is, certificates that 378do not originate from a trusted CA but are self-signed will be 379accepted. 380.It Em Ca-directory 381A directory containing PEM certificates of certification authorities 382that we trust to sign other certificates. 383Note that for a CA to be really trusted, it needs to be somehow 384referred to by policy, in 385.Xr isakmpd.policy 5 . 386The certificates in this directory are used for the actual X.509 387authentication and for cross-referencing policies that refer to 388Distinguished Names (DNs). 389Keeping a separate directory (as opposed to integrating policies 390and X.509 CA certificates) allows for maintenance of a list of 391"well-known" CAs without actually having to trust all (or any) of them. 392.It Em Cert-directory 393A directory containing PEM certificates that we trust to be valid. 394These certificates are used in preference to those passed in messages and 395are required to have a subjectAltName extension containing the certificate 396holder identity; usually IP address, FQDN, or User FQDN. 397.It Em Private-key 398The private key matching the public key of our certificate (which should be 399in the "Cert-directory", and have an appropriate subjectAltName field). 400.It Em Private-key-directory 401A directory containing private keys named after an ID (IP addresses, 402.Dq user@domain , 403or hostnames). 404.El 405.El 406.Sh REFERRED-TO SECTIONS 407.Bl -hang -width Ds 408.It Aq Sy ISAKMP-peer 409Parameters for negotiation with an ISAKMP peer 410.Bl -tag -width Ds 411.It Em Address 412If existent, the IP address of the peer. 413.It Em Authentication 414If existent, authentication data for this specific peer. 415In the case of a pre-shared key, this is the key value itself. 416.It Em Configuration 417The name of the ISAKMP-configuration section to use. 418Look at 419.Aq Sy ISAKMP-configuration 420below. 421If unspecified, defaults to "Default-phase-1-configuration". 422.It Em Flags 423A comma-separated list of flags controlling the further 424handling of the ISAKMP SA. 425Currently there are no specific ISAKMP SA flags defined. 426.It Em ID 427If existent, the name of the section that describes the 428local client ID that we should present to our peer. 429If not present, it 430defaults to the address of the local interface we are sending packets 431over to the remote daemon. 432Look at 433.Aq Sy Phase1-ID 434below. 435.It Em Local-address 436The Local IP address to use, if we are multi-homed, or have aliases. 437.It Em Phase 438The constant 439.Sq 1 , 440as ISAKMP-peers and IPsec-connections 441really are handled by the same code inside 442.Xr isakmpd 8 . 443.It Em Port 444For UDP, the UDP port number to send to. 445This is optional; 446the default value is 500 which is the IANA-registered number for ISAKMP. 447.It Em Remote-ID 448If existent, the name of the section that describes the remote client 449ID we expect the remote daemon to send us. 450If not present, it defaults to the address of the remote daemon. 451Look at 452.Aq Sy Phase1-ID 453below. 454.It Em Transport 455The name of the transport protocol; defaults to UDP. 456.El 457.It Aq Sy Phase1-ID 458Parameters for Phase 1 negotiation 459.Bl -tag -width Ds 460.It Em Address 461If the ID-type is 462.Li IPV4_ADDR 463or 464.Li IPV6_ADDR , 465this tag should exist and be an IP address. 466.It Em ID-type 467The ID type as given by the RFC specifications. 468For phase 1 this is currently 469.Li IPV4_ADDR , 470.Li IPV4_ADDR_SUBNET , 471.Li IPV6_ADDR , 472.Li IPV6_ADDR_SUBNET , 473.Li FQDN , 474.Li USER_FQDN , 475or 476.Li KEY_ID . 477.It Em Name 478If the ID-type is 479.Li FQDN , 480.Li USER_FQDN , 481or 482.Li KEY_ID , 483this tag should exist and contain a domain name, user@domain, or 484other identifying string respectively. 485.Pp 486In the case of 487.Li KEY_ID , 488note that the IKE protocol allows any octet sequence to be sent or 489received under this payload, potentially including non-printable 490ones. 491.Xr isakmpd 8 492can only transmit printable 493.Li KEY_ID 494payloads, but can receive and process arbitrary 495.Li KEY_ID 496payloads. 497This effectively means that non-printable 498.Li KEY_ID 499remote identities cannot be verified through this means, although it 500is still possible to do so through 501.Xr isakmpd.policy 5 . 502.It Em Netmask 503If the ID-type is 504.Li IPV4_ADDR_SUBNET 505or 506.Li IPV6_ADDR_SUBNET , 507this tag should exist and 508be a network subnet mask. 509.It Em Network 510If the ID-type is 511.Li IPV4_ADDR_SUBNET 512or 513.Li IPV6_ADDR_SUBNET , 514this tag should exist and 515be a network address. 516.El 517.It Aq Sy ISAKMP-configuration 518Parameters for ISAKMP configuration 519.Bl -tag -width Ds 520.It Em DOI 521The domain of interpretation as given by the RFCs. 522Normally 523.Li IPSEC . 524If unspecified, defaults to 525.Li IPSEC . 526.It Em EXCHANGE_TYPE 527The exchange type as given by the RFCs. 528For main mode this is 529.Li ID_PROT 530and for aggressive mode it is 531.Li AGGRESSIVE . 532.It Em Transforms 533A list of proposed transforms to use for protecting the 534ISAKMP traffic. 535These are actually names for sections 536further describing the transforms. 537Look at 538.Aq Sy ISAKMP-transform 539below. 540.El 541.It Aq Sy ISAKMP-transform 542Parameters for ISAKMP authentication 543.Bl -tag -width Ds 544.It Em AUTHENTICATION_METHOD 545The authentication method as the RFCs name it, or ANY. 546.It Em ENCRYPTION_ALGORITHM 547The encryption algorithm as the RFCs name it, or ANY to denote that any 548encryption algorithm proposed will be accepted. 549.It Em GROUP_DESCRIPTION 550The group used for Diffie-Hellman exponentiations, or ANY. 551The names are symbolic, like 552.Li MODP_768 , MODP_1024 , EC_155 , 553and 554.Li EC_185 . 555.It Em HASH_ALGORITHM 556The hash algorithm as the RFCs name it, or ANY. 557.It Em KEY_LENGTH 558For encryption algorithms with variable key length, this is 559where the offered/accepted keylengths are described. 560The value is of the offer-accept kind described above. 561.It Em Life 562A list of lifetime descriptions, or ANY. 563In the former case, each 564element is in itself a name of the section that defines the lifetime. 565Look at 566.Aq Sy Lifetime 567below. 568If it is set to ANY, then any type of 569proposed lifetime type and value will be accepted. 570.It Em PRF 571The algorithm to use for the keyed pseudo-random function (used for key 572derivation and authentication in phase 1), or ANY. 573.El 574.It Aq Sy Lifetime 575Parameters for connection duration 576.Bl -tag -width Ds 577.It Em LIFE_DURATION 578An offer/accept kind of value; see above. 579Can also be set to ANY. 580.It Em LIFE_TYPE 581.Li SECONDS 582or 583.Li KILOBYTES 584depending on the type of the duration. 585Notice that this field may NOT be set to ANY. 586.El 587.It Aq Sy IPsec-connection 588Parameters for IPsec connection configuration 589.Bl -tag -width Ds 590.It Em Configuration 591The name of the IPsec-configuration section to use. 592Look at 593.Aq Sy IPsec-configuration 594below. 595.It Em Flags 596A comma-separated list of flags controlling the further 597handling of the IPsec SA. 598Currently only one flag is defined: 599.Bl -tag -width 12n 600.It Em Active-only 601If this flag is given and this 602.Aq Sy IPsec-connection 603is part of the phase 2 604connections we automatically keep up, it will not automatically be used for 605accepting connections from the peer. 606.El 607.It Em ISAKMP-peer 608The name of the ISAKMP-peer to talk to in order to 609set up this connection. 610The value is the name of an 611.Aq Sy ISAKMP-peer 612section. 613See above. 614.It Em Local-ID 615If existent, the name of the section that describes the 616optional local client ID that we should present to our peer. 617It is also used when we act as responders to find out what 618.Aq Sy IPsec-connection 619we are dealing with. 620Look at 621.Aq Sy IPsec-ID 622below. 623.It Em Phase 624The constant 625.Sq 2 , 626as ISAKMP-peers and IPsec-connections 627really are handled by the same code inside 628.Xr isakmpd 8 . 629.It Em Remote-ID 630If existent, the name of the section that describes the 631optional remote client ID that we should present to our peer. 632It is also used when we act as responders to find out what 633.Aq Sy IPsec-connection 634we are dealing with. 635Look at 636.Aq Sy IPsec-ID 637below. 638.It Em PF-Tag 639Add a 640.Xr pf 4 641tag to all packets of phase 2 SAs created for this connection. 642This will allow matching packets for this connection by defining 643rules in 644.Xr pf.conf 5 645using the 646.Em tagged 647keyword. 648.Pp 649The following variables can be used in tags to include information 650from the remote peer on runtime: 651.Pp 652.Bl -tag -width $domain -compact -offset indent 653.It Ar $id 654The remote phase 1 ID. 655It will be expanded to 656.Ar id-type/id-value , 657e.g.\& 658.Ar fqdn/foo.bar.org . 659.It Ar $domain 660Extract the domain from IDs of type FQDN or UFQDN. 661.El 662.Pp 663For example, if the ID is 664.Ar fqdn/foo.bar.org 665or 666.Ar ufqdn/user@bar.org , 667.Dq PF-Tag=ipsec-$domain 668expands to 669.Dq ipsec-bar.org . 670The variable expansion for the 671.Ar PF-Tag 672directive occurs only at runtime, not during configuration file parse time. 673.It Em Interface 674Specify a 675.Xr sec 4 676interface minor number that the SAs will be used with. 677Configuring 678.Ar Interface 679also disables the insertion of flows, and instead relies on the 680routing of packets over the associated 681.Xr sec 4 682interface. 683.El 684.It Aq Sy IPsec-configuration 685Parameters for IPsec configuration 686.Bl -tag -width Ds 687.It Em DOI 688The domain of interpretation as given by the RFCs. 689Normally 690.Li IPSEC . 691If unspecified, defaults to 692.Li IPSEC . 693.It Em EXCHANGE_TYPE 694The exchange type as given by the RFCs. 695For quick mode this is 696.Li QUICK_MODE . 697.It Em Suites 698A list of protection suites (bundles of protocols) usable for 699protecting the IP traffic. 700Each of the list elements is a name of an 701.Aq Sy IPsec-suite 702section. 703See below. 704.El 705.It Aq Sy IPsec-suite 706Parameters for IPsec protection suite configuration 707.Bl -tag -width Ds 708.It Em Protocols 709A list of the protocols included in this protection suite. 710Each of the list elements is a name of an 711.Aq Sy IPsec-protocol 712section. 713See below. 714.El 715.It Aq Sy IPsec-protocol 716Parameters for IPsec protocol configuration 717.Bl -tag -width Ds 718.It Em PROTOCOL_ID 719The protocol as given by the RFCs. 720Acceptable values are currently 721.Li IPSEC_AH 722and 723.Li IPSEC_ESP . 724.It Em ReplayWindow 725The size of the window used for replay protection. 726This is normally left alone. 727Look at the ESP and AH RFCs for a better description. 728.It Em Transforms 729A list of transforms usable for implementing the protocol. 730Each of the list elements is a name of an 731.Aq Sy IPsec-transform 732section. 733See below. 734.El 735.It Aq Sy IPsec-transform 736Parameters for IPsec transform configuration 737.Bl -tag -width Ds 738.It Em AUTHENTICATION_ALGORITHM 739The optional authentication algorithm, or ANY in the case of this 740being an ESP transform. 741.It Em ENCAPSULATION_MODE 742The encapsulation mode as given by the RFCs. 743This means TRANSPORT or TUNNEL. 744.It Em GROUP_DESCRIPTION 745An optional (provides PFS if present) Diffie-Hellman group 746description. 747The values are the same as those for GROUP_DESCRIPTION in 748.Aq Sy ISAKMP-transform 749sections shown above. 750.It Em KEY_LENGTH 751For encryption algorithms with variable key length, this is 752where the offered keylength is described. 753.It Em Life 754List of lifetimes, each element is a 755.Aq Sy Lifetime 756section name. 757.It Em TRANSFORM_ID 758The transform ID as given by the RFCs, or ANY to denote that any 759transform proposed will be accepted. 760.El 761.It Aq Sy IPsec-ID 762Parameters for IPsec ID configuration 763.Bl -tag -width Ds 764.It Em Address 765If the ID-type is 766.Li IPV4_ADDR 767or 768.Li IPV6_ADDR , 769this tag should exist and be an IP address, an interface name, or the 770.Em default 771keyword. 772If an interface is used, the first address of the appropriate 773family will be used. 774The 775.Em default 776keyword uses the interface associated with the default route. 777In the case of IPv6, link-local addresses will be skipped if 778addresses which are not link-local exist. 779If the address on the interface changes, 780.Xr isakmpd 8 781will not track the change. 782The configuration must be reloaded to learn the new address. 783.It Em ID-type 784The ID type as given by the RFCs. 785For IPsec this is currently 786.Li IPV4_ADDR , 787.Li IPV6_ADDR , 788.Li IPV4_ADDR_SUBNET , 789or 790.Li IPV6_ADDR_SUBNET . 791.It Em Netmask 792If the ID-type is 793.Li IPV4_ADDR_SUBNET 794or 795.Li IPV6_ADDR_SUBNET , 796this tag should exist and 797be a network subnet mask or an interface. 798When an interface is specified, the netmask is the mask associated with the 799.Em Network . 800The 801.Em default 802keyword uses the interface associated with the default route. 803.It Em Network 804If the ID-type is 805.Li IPV4_ADDR_SUBNET 806or 807.Li IPV6_ADDR_SUBNET , 808this tag should exist and be a network address, an interface, or the 809.Em default 810keyword. 811When an interface is specified, the network is selected as with the 812.Em Address 813tag. 814.It Em Port 815If the ID-type is 816.Li IPV4_ADDR , 817.Li IPV4_ADDR_SUBNET , 818.Li IPV6_ADDR , 819or 820.Li IPV6_ADDR_SUBNET , 821this tag indicates what source or destination port is allowed to be 822transported over the SA (depending on whether this is a local or 823remote ID). 824If left unspecified, all ports of the given transport protocol 825will be transmitted (or permitted) over the SA. 826The 827.Em Protocol 828tag must be specified in conjunction with this tag. 829.It Em Protocol 830If the ID-type is 831.Li IPV4_ADDR , 832.Li IPV4_ADDR_SUBNET , 833.Li IPV6_ADDR , 834or 835.Li IPV6_ADDR_SUBNET , 836this tag indicates what transport protocol should be transmitted over 837the SA. 838If left unspecified, all transport protocols between the two address 839(ranges) will be sent (or permitted) over that SA. 840.El 841.El 842.Sh OTHER SECTIONS 843.Bl -hang -width 8n 844.It Aq Sy IKECFG-ID 845Parameters to use with IKE mode-config. 846One ID per peer. 847.Pp 848An IKECFG-ID is written as [<ID-type>/<name>]. 849The following ID types are supported: 850.Pp 851.Bl -tag -width "ASN1_DNXX" -offset indent -compact 852.It IPv4 853[ipv4/A.B.C.D] 854.It IPv6 855[ipv6/abcd:abcd::ab:cd] 856.It FQDN 857[fqdn/foo.bar.org] 858.It UFQDN 859[ufqdn/user@foo.bar.org] 860.It ASN1_DN 861[asn1_dn//C=aa/O=cc/...] (Note the double slashes as the DN itself 862starts with a 863.Sq / . ) 864.El 865.Pp 866Each section specifies what configuration values to return to the peer 867requesting IKE mode-config. 868Currently supported values are: 869.Pp 870.Bl -tag -width "WINS-serverXX" -offset indent -compact 871.It Em Address 872The peer's network address. 873.It Em Netmask 874The peer's netmask. 875.It Em Nameserver 876The IP address of a DNS nameserver. 877.It Em WINS-server 878The IP address of a WINS server. 879.El 880.It Aq Sy Initiator-ID 881Parameters for peer initiator configuration 882.Pp 883During phase 1 negotiation 884.Xr isakmpd 8 885looks for a pre-shared key in the 886.Aq Sy ISAKMP-peer 887section. 888If no Authentication data is specified in that section, and 889.Xr isakmpd 8 890is not the initiator, it looks for Authentication data in a section named after 891the initiator's phase 1 ID. 892This allows mobile users with dynamic IP addresses 893to have different shared secrets. 894.Pp 895This only works for aggressive mode because in main mode the remote 896initiator ID would not yet be known. 897Note, however, that use of aggressive mode is discouraged. 898See 899.Sx CAVEATS , 900below. 901.Pp 902The name of the 903.Aq Sy Initiator-ID 904section depends on the ID type sent by the initiator. 905Currently this can be: 906.Pp 907.Bl -tag -width "UFQDNXX" -offset indent -compact 908.It IPv4 909[A.B.C.D] 910.It IPv6 911[abcd:abcd::ab:cd] 912.It FQDN 913[foo.bar.org] 914.It UFQDN 915[user@foo.bar.org] 916.El 917.El 918.Sh FILES 919.Bl -tag -width /etc/isakmpd/isakmpd.conf 920.It Pa /etc/isakmpd/isakmpd.conf 921The default 922.Xr isakmpd 8 923configuration file. 924.El 925.Sh EXAMPLES 926An example of a configuration file: 927.Bd -literal 928# A configuration sample for the isakmpd ISAKMP/Oakley (aka IKEv1) daemon. 929 930[General] 931Listen-on= 10.1.0.2 932 933# Incoming phase 1 negotiations are multiplexed on the source IP address 934[Phase 1] 93510.1.0.1= ISAKMP-peer-west 936 937# These connections are walked over after config file parsing and told 938# to the application layer so that it will inform us when traffic wants to 939# pass over them. This means we can do on-demand keying. 940[Phase 2] 941Connections= IPsec-east-west 942 943# Default values are commented out. 944[ISAKMP-peer-west] 945Phase= 1 946#Transport= udp 947Local-address= 10.1.0.2 948Address= 10.1.0.1 949#Port= isakmp 950#Port= 500 951#Configuration= Default-phase-1-configuration 952Authentication= mekmitasdigoat 953#Flags= 954 955[IPsec-east-west] 956Phase= 2 957ISAKMP-peer= ISAKMP-peer-west 958Configuration= Default-quick-mode 959Local-ID= Net-east 960Remote-ID= Net-west 961#Flags= 962 963[Net-west] 964ID-type= IPV4_ADDR_SUBNET 965Network= 192.168.1.0 966Netmask= 255.255.255.0 967 968[Net-east] 969ID-type= IPV4_ADDR_SUBNET 970Network= 192.168.2.0 971Netmask= 255.255.255.0 972 973# Quick mode descriptions 974 975[Default-quick-mode] 976EXCHANGE_TYPE= QUICK_MODE 977Suites= QM-ESP-3DES-SHA-PFS-SUITE,QM-ESP-AES-SHA-PFS-SUITE 978 979# Data for an IKE mode-config peer 980[asn1_dn//C=SE/L=SomeCity/O=SomeCompany/CN=SomePeer.company.com] 981Address= 192.168.1.123 982Netmask= 255.255.255.0 983Nameserver= 192.168.1.10 984WINS-server= 192.168.1.11 985 986# pre-shared key based on initiator's phase 1 ID 987[foo.bar.org] 988Authentication= mekmitasdigoat 989 990# 991# ##################################################################### 992# All configuration data below this point is not required as the example 993# uses the predefined Main Mode transform and Quick Mode suite names. 994# It is included here for completeness. Note the default values for the 995# [General] and [X509-certificates] sections just below. 996# ##################################################################### 997# 998 999[General] 1000Policy-file= /etc/isakmpd/isakmpd.policy 1001Retransmits= 3 1002Exchange-max-time= 120 1003 1004# KeyNote credential storage 1005[KeyNote] 1006Credential-directory= /etc/isakmpd/keynote/ 1007 1008# Certificates stored in PEM format 1009[X509-certificates] 1010CA-directory= /etc/isakmpd/ca/ 1011Cert-directory= /etc/isakmpd/certs/ 1012CRL-directory= /etc/isakmpd/crls/ 1013Private-key= /etc/isakmpd/private/local.key 1014 1015# Default phase 1 description (Main Mode) 1016 1017[Default-phase-1-configuration] 1018EXCHANGE_TYPE= ID_PROT 1019Transforms= 3DES-SHA 1020 1021# Main mode transforms 1022###################### 1023 1024# 3DES 1025 1026[3DES-SHA] 1027ENCRYPTION_ALGORITHM= 3DES_CBC 1028HASH_ALGORITHM= SHA 1029AUTHENTICATION_METHOD= PRE_SHARED 1030GROUP_DESCRIPTION= MODP_1024 1031Life= LIFE_MAIN_MODE 1032 1033# AES 1034 1035[AES-SHA] 1036ENCRYPTION_ALGORITHM= AES_CBC 1037KEY_LENGTH= 128,128:256 1038HASH_ALGORITHM= SHA 1039AUTHENTICATION_METHOD= PRE_SHARED 1040GROUP_DESCRIPTION= MODP_1024 1041Life= LIFE_MAIN_MODE 1042 1043# AES-128 1044 1045[AES-128-SHA] 1046ENCRYPTION_ALGORITHM= AES_CBC 1047KEY_LENGTH= 128,128:128 1048HASH_ALGORITHM= SHA 1049AUTHENTICATION_METHOD= PRE_SHARED 1050GROUP_DESCRIPTION= MODP_1024 1051Life= LIFE_MAIN_MODE 1052 1053# AES-192 1054 1055[AES-192-SHA] 1056ENCRYPTION_ALGORITHM= AES_CBC 1057KEY_LENGTH= 192,192:192 1058HASH_ALGORITHM= SHA 1059AUTHENTICATION_METHOD= PRE_SHARED 1060GROUP_DESCRIPTION= MODP_1024 1061Life= LIFE_MAIN_MODE 1062 1063# AES-256 1064 1065[AES-256-SHA] 1066ENCRYPTION_ALGORITHM= AES_CBC 1067KEY_LENGTH= 256,256:256 1068HASH_ALGORITHM= SHA 1069AUTHENTICATION_METHOD= PRE_SHARED 1070GROUP_DESCRIPTION= MODP_1024 1071Life= LIFE_MAIN_MODE 1072 1073# Blowfish 1074 1075[BLF-SHA] 1076ENCRYPTION_ALGORITHM= BLOWFISH_CBC 1077KEY_LENGTH= 128,96:192 1078HASH_ALGORITHM= SHA 1079AUTHENTICATION_METHOD= PRE_SHARED 1080GROUP_DESCRIPTION= MODP_1024 1081Life= LIFE_MAIN_MODE 1082 1083# Blowfish, using DH group 4 (non-default) 1084[BLF-SHA-EC185] 1085ENCRYPTION_ALGORITHM= BLOWFISH_CBC 1086KEY_LENGTH= 128,96:192 1087HASH_ALGORITHM= SHA 1088AUTHENTICATION_METHOD= PRE_SHARED 1089GROUP_DESCRIPTION= EC2N_185 1090Life= LIFE_MAIN_MODE 1091 1092# Quick mode protection suites 1093############################## 1094 1095# 3DES 1096 1097[QM-ESP-3DES-SHA-SUITE] 1098Protocols= QM-ESP-3DES-SHA 1099 1100[QM-ESP-3DES-SHA-PFS-SUITE] 1101Protocols= QM-ESP-3DES-SHA-PFS 1102 1103# AES 1104 1105[QM-ESP-AES-SHA-SUITE] 1106Protocols= QM-ESP-AES-SHA 1107 1108[QM-ESP-AES-SHA-PFS-SUITE] 1109Protocols= QM-ESP-AES-SHA-PFS 1110 1111# AES-128 1112 1113[QM-ESP-AES-128-SHA-SUITE] 1114Protocols= QM-ESP-AES-128-SHA 1115 1116[QM-ESP-AES-128-SHA-PFS-SUITE] 1117Protocols= QM-ESP-AES-128-SHA-PFS 1118 1119# AES-192 1120 1121[QM-ESP-AES-192-SHA-SUITE] 1122Protocols= QM-ESP-AES-192-SHA 1123 1124[QM-ESP-AES-192-SHA-PFS-SUITE] 1125Protocols= QM-ESP-AES-192-SHA-PFS 1126 1127# AES-256 1128 1129[QM-ESP-AES-256-SHA-SUITE] 1130Protocols= QM-ESP-AES-256-SHA 1131 1132[QM-ESP-AES-256-SHA-PFS-SUITE] 1133Protocols= QM-ESP-AES-256-SHA-PFS 1134 1135# AH 1136 1137[QM-AH-MD5-SUITE] 1138Protocols= QM-AH-MD5 1139 1140[QM-AH-MD5-PFS-SUITE] 1141Protocols= QM-AH-MD5-PFS 1142 1143# AH + ESP (non-default) 1144 1145[QM-AH-MD5-ESP-3DES-SHA-SUITE] 1146Protocols= QM-AH-MD5,QM-ESP-3DES-SHA 1147 1148[QM-ESP-3DES-SHA-AH-MD5-SUITE] 1149Protocols= QM-ESP-3DES-SHA,QM-AH-MD5 1150 1151# Quick mode protocols 1152 1153# 3DES 1154 1155[QM-ESP-3DES-SHA] 1156PROTOCOL_ID= IPSEC_ESP 1157Transforms= QM-ESP-3DES-SHA-XF 1158 1159[QM-ESP-3DES-SHA-PFS] 1160PROTOCOL_ID= IPSEC_ESP 1161Transforms= QM-ESP-3DES-SHA-PFS-XF 1162 1163[QM-ESP-3DES-SHA-TRP] 1164PROTOCOL_ID= IPSEC_ESP 1165Transforms= QM-ESP-3DES-SHA-TRP-XF 1166 1167# AES 1168 1169[QM-ESP-AES-SHA] 1170PROTOCOL_ID= IPSEC_ESP 1171Transforms= QM-ESP-AES-SHA-XF 1172 1173[QM-ESP-AES-SHA-PFS] 1174PROTOCOL_ID= IPSEC_ESP 1175Transforms= QM-ESP-AES-SHA-PFS-XF 1176 1177[QM-ESP-AES-SHA-TRP] 1178PROTOCOL_ID= IPSEC_ESP 1179Transforms= QM-ESP-AES-SHA-TRP-XF 1180 1181# AES-128 1182 1183[QM-ESP-AES-128-SHA] 1184PROTOCOL_ID= IPSEC_ESP 1185Transforms= QM-ESP-AES-128-SHA-XF 1186 1187[QM-ESP-AES-128-SHA-PFS] 1188PROTOCOL_ID= IPSEC_ESP 1189Transforms= QM-ESP-AES-128-SHA-PFS-XF 1190 1191[QM-ESP-AES-128-SHA-TRP] 1192PROTOCOL_ID= IPSEC_ESP 1193Transforms= QM-ESP-AES-128-SHA-TRP-XF 1194 1195# AES-192 1196 1197[QM-ESP-AES-192-SHA] 1198PROTOCOL_ID= IPSEC_ESP 1199Transforms= QM-ESP-AES-192-SHA-XF 1200 1201[QM-ESP-AES-192-SHA-PFS] 1202PROTOCOL_ID= IPSEC_ESP 1203Transforms= QM-ESP-AES-192-SHA-PFS-XF 1204 1205[QM-ESP-AES-192-SHA-TRP] 1206PROTOCOL_ID= IPSEC_ESP 1207Transforms= QM-ESP-AES-192-SHA-TRP-XF 1208 1209# AES-256 1210 1211[QM-ESP-AES-256-SHA] 1212PROTOCOL_ID= IPSEC_ESP 1213Transforms= QM-ESP-AES-256-SHA-XF 1214 1215[QM-ESP-AES-256-SHA-PFS] 1216PROTOCOL_ID= IPSEC_ESP 1217Transforms= QM-ESP-AES-256-SHA-PFS-XF 1218 1219[QM-ESP-AES-256-SHA-TRP] 1220PROTOCOL_ID= IPSEC_ESP 1221Transforms= QM-ESP-AES-256-SHA-TRP-XF 1222 1223 1224# AH MD5 1225 1226[QM-AH-MD5] 1227PROTOCOL_ID= IPSEC_AH 1228Transforms= QM-AH-MD5-XF 1229 1230[QM-AH-MD5-PFS] 1231PROTOCOL_ID= IPSEC_AH 1232Transforms= QM-AH-MD5-PFS-XF 1233 1234# Quick mode transforms 1235 1236# 3DES 1237 1238[QM-ESP-3DES-SHA-XF] 1239TRANSFORM_ID= 3DES 1240ENCAPSULATION_MODE= TUNNEL 1241AUTHENTICATION_ALGORITHM= HMAC_SHA 1242Life= LIFE_QUICK_MODE 1243 1244[QM-ESP-3DES-SHA-PFS-XF] 1245TRANSFORM_ID= 3DES 1246ENCAPSULATION_MODE= TUNNEL 1247AUTHENTICATION_ALGORITHM= HMAC_SHA 1248GROUP_DESCRIPTION= MODP_1024 1249Life= LIFE_QUICK_MODE 1250 1251[QM-ESP-3DES-SHA-TRP-XF] 1252TRANSFORM_ID= 3DES 1253ENCAPSULATION_MODE= TRANSPORT 1254AUTHENTICATION_ALGORITHM= HMAC_SHA 1255Life= LIFE_QUICK_MODE 1256 1257# AES 1258 1259[QM-ESP-AES-SHA-XF] 1260TRANSFORM_ID= AES 1261ENCAPSULATION_MODE= TUNNEL 1262AUTHENTICATION_ALGORITHM= HMAC_SHA 1263KEY_LENGTH= 128 1264Life= LIFE_QUICK_MODE 1265 1266[QM-ESP-AES-SHA-PFS-XF] 1267TRANSFORM_ID= AES 1268ENCAPSULATION_MODE= TUNNEL 1269AUTHENTICATION_ALGORITHM= HMAC_SHA 1270GROUP_DESCRIPTION= MODP_1024 1271KEY_LENGTH= 128 1272Life= LIFE_QUICK_MODE 1273 1274[QM-ESP-AES-SHA-TRP-XF] 1275TRANSFORM_ID= AES 1276ENCAPSULATION_MODE= TRANSPORT 1277AUTHENTICATION_ALGORITHM= HMAC_SHA 1278KEY_LENGTH= 128 1279Life= LIFE_QUICK_MODE 1280 1281# AES-128 1282 1283[QM-ESP-AES-128-SHA-XF] 1284TRANSFORM_ID= AES 1285ENCAPSULATION_MODE= TUNNEL 1286AUTHENTICATION_ALGORITHM= HMAC_SHA 1287KEY_LENGTH= 128 1288Life= LIFE_QUICK_MODE 1289 1290[QM-ESP-AES-128-SHA-PFS-XF] 1291TRANSFORM_ID= AES 1292ENCAPSULATION_MODE= TUNNEL 1293AUTHENTICATION_ALGORITHM= HMAC_SHA 1294GROUP_DESCRIPTION= MODP_1024 1295KEY_LENGTH= 128 1296Life= LIFE_QUICK_MODE 1297 1298[QM-ESP-AES-128-SHA-TRP-XF] 1299TRANSFORM_ID= AES 1300ENCAPSULATION_MODE= TRANSPORT 1301AUTHENTICATION_ALGORITHM= HMAC_SHA 1302KEY_LENGTH= 128 1303Life= LIFE_QUICK_MODE 1304 1305# AES-192 1306 1307[QM-ESP-AES-192-SHA-XF] 1308TRANSFORM_ID= AES 1309ENCAPSULATION_MODE= TUNNEL 1310AUTHENTICATION_ALGORITHM= HMAC_SHA 1311KEY_LENGTH= 192 1312Life= LIFE_QUICK_MODE 1313 1314[QM-ESP-AES-192-SHA-PFS-XF] 1315TRANSFORM_ID= AES 1316ENCAPSULATION_MODE= TUNNEL 1317AUTHENTICATION_ALGORITHM= HMAC_SHA 1318GROUP_DESCRIPTION= MODP_1024 1319KEY_LENGTH= 192 1320Life= LIFE_QUICK_MODE 1321 1322[QM-ESP-AES-192-SHA-TRP-XF] 1323TRANSFORM_ID= AES 1324ENCAPSULATION_MODE= TRANSPORT 1325AUTHENTICATION_ALGORITHM= HMAC_SHA 1326KEY_LENGTH= 192 1327Life= LIFE_QUICK_MODE 1328 1329# AES-256 1330 1331[QM-ESP-AES-256-SHA-XF] 1332TRANSFORM_ID= AES 1333ENCAPSULATION_MODE= TUNNEL 1334AUTHENTICATION_ALGORITHM= HMAC_SHA 1335KEY_LENGTH= 256 1336Life= LIFE_QUICK_MODE 1337 1338[QM-ESP-AES-256-SHA-PFS-XF] 1339TRANSFORM_ID= AES 1340ENCAPSULATION_MODE= TUNNEL 1341AUTHENTICATION_ALGORITHM= HMAC_SHA 1342GROUP_DESCRIPTION= MODP_1024 1343KEY_LENGTH= 256 1344Life= LIFE_QUICK_MODE 1345 1346[QM-ESP-AES-256-SHA-TRP-XF] 1347TRANSFORM_ID= AES 1348ENCAPSULATION_MODE= TRANSPORT 1349AUTHENTICATION_ALGORITHM= HMAC_SHA 1350KEY_LENGTH= 256 1351Life= LIFE_QUICK_MODE 1352 1353 1354# AH 1355 1356[QM-AH-MD5-XF] 1357TRANSFORM_ID= MD5 1358ENCAPSULATION_MODE= TUNNEL 1359AUTHENTICATION_ALGORITHM= HMAC_MD5 1360Life= LIFE_QUICK_MODE 1361 1362[QM-AH-MD5-PFS-XF] 1363TRANSFORM_ID= MD5 1364ENCAPSULATION_MODE= TUNNEL 1365GROUP_DESCRIPTION= MODP_1024 1366Life= LIFE_QUICK_MODE 1367 1368[Sample-Life-Time] 1369LIFE_TYPE= SECONDS 1370LIFE_DURATION= 3600,1800:7200 1371 1372[Sample-Life-Volume] 1373LIFE_TYPE= KILOBYTES 1374LIFE_DURATION= 1000,768:1536 1375.Ed 1376.Sh SEE ALSO 1377.Xr keynote 1 , 1378.Xr openssl 1 , 1379.Xr ipsec 4 , 1380.Xr keynote 4 , 1381.Xr isakmpd.policy 5 , 1382.Xr isakmpd 8 1383.Sh CAVEATS 1384Using aggressive mode is discouraged due to various design problems. 1385If your peer only supports aggressive mode, consider replacing that 1386peer with a sane ISAKMP/IKE implementation. 1387For details see 1388.Lk http://www.usenix.org/publications/login/1999-12/features/harmful.html . 1389.Sh BUGS 1390The RFCs do not permit differing DH groups in the same proposal for 1391aggressive and quick mode exchanges. 1392Mixing both PFS and non-PFS suites in a quick mode proposal is not possible, 1393as PFS implies using a DH group. 1394