50 lines
1.0 KiB
Plaintext
50 lines
1.0 KiB
Plaintext
# ipsec.conf - strongSwan IPsec configuration file
|
|
# https://developers.microad.co.jp/entry/2022/05/30/100000
|
|
|
|
config setup
|
|
# strictcrlpolicy=yes
|
|
# uniqueids = no
|
|
|
|
# left: onprem Strongswan
|
|
# right: GCP VPN
|
|
|
|
conn %default
|
|
ikelifetime=60m
|
|
keylife=20m
|
|
rekeymargin=3m
|
|
keyingtries=1
|
|
authby=secret
|
|
keyexchange=ikev2
|
|
mobike=no
|
|
type=tunnel
|
|
leftsubnet=0.0.0.0/0,::/0
|
|
rightsubnet=0.0.0.0/0,::/0
|
|
|
|
conn gcp-vpn-tunnel01
|
|
esp=aes128-sha1-modp1024,3des-sha1-modp1024
|
|
ikelifetime=600m
|
|
keylife=180m
|
|
rekeymargin=1m
|
|
keyingtries=5
|
|
keyexchange=ikev2
|
|
left = ${ Own HostIP }
|
|
leftid = ${ PublicIP of own Site }
|
|
leftupdown = /etc/ipsec-vti.sh
|
|
right = ${ opposite IP address }
|
|
auto = start
|
|
mark=100
|
|
|
|
conn gcp-vpn-tunnel02
|
|
esp=aes128-sha1-modp1024,3des-sha1-modp1024
|
|
ikelifetime=600m
|
|
keylife=180m
|
|
rekeymargin=1m
|
|
keyingtries=5
|
|
keyexchange=ikev2
|
|
left = ${ Own HostIP }
|
|
leftid = ${ PublicIP of own Site }
|
|
leftupdown = /etc/ipsec-vti.sh
|
|
right = ${ opposite IP address }
|
|
auto = start
|
|
mark=200
|