path certificate "/etc/ssl/new";

# "log" specifies logging level. It is followed by either "notify", "debug"
# or "debug2".
#log debug;

# "padding" defines some padding parameters. You should not touch these.
padding {
	maximum_length	20;	# maximum padding length.
	randomize	off;	# enable randomize length.
	strict_check	off;	# enable strict check.
	exclusive_tail	off;	# extract last one octet.
}

listen
{
	isakmp		aaa.bbb.ccc.ddd [500];
}

# Specify various default timers.
timer {
	# These value can be changed per remote node.
	counter		5;		# maximum trying count to send.
	interval	20 sec;		# maximum interval to resend.
	persend		1;		# the number of packets per send.

	# maximum time to wait for completing each phase.
	phase1 30 sec;
	phase2 15 sec;
}

remote aaa.bbb.ccc.ddd [500] {
	exchange_mode		main;
	doi			ipsec_doi;

	my_identifier		asn1dn;
	peers_identifier	asn1dn;
	verify_identifier	on;
	certificate_type	x509 "host1.ru.crt" "host1.ru.key";
	ca_type			x509 "ca.crt";
	dpd_delay		10;

	lifetime time		12 hour; # sec,min,hour
	passive			off;
	proposal_check		strict; # obey, strict, or claim
	nat_traversal		off;

	proposal {
		encryption_algorithm	aes 256;
		hash_algorithm		sha256;
		authentication_method	rsasig;
		lifetime time		30 sec;
		dh_group		16;
	}
}

remote aaa.bbb.ccc.ddd [500] {
	exchange_mode		main;
	doi			ipsec_doi;

	my_identifier		asn1dn;
	peers_identifier	asn1dn;
	verify_identifier	on;
	certificate_type	x509 "host1.ru.crt" "host1.ru.key";
	ca_type			x509 "ca.crt";
	dpd_delay		10;

	lifetime time		12 hour; # sec,min,hour
	passive			off;
	proposal_check		strict; # obey, strict, or claim
	nat_traversal		off;

	proposal {
		encryption_algorithm	aes 256;
		hash_algorithm		sha256;
		authentication_method	rsasig;
		lifetime time		30 sec;
		dh_group		16;
	}
}

remote aaa.bbb.ccc.ddd [500] {
	exchange_mode		main;
	doi			ipsec_doi;

	my_identifier		asn1dn;
	peers_identifier	asn1dn;
	verify_identifier	on;
	certificate_type	x509 "host1.ru.crt" "host1.ru.key";
	ca_type			x509 "ca.crt";
	dpd_delay		10;

	lifetime time		12 hour; # sec,min,hour
	passive			off;
	proposal_check		strict; # obey, strict, or claim
	nat_traversal		off;

	proposal {
		encryption_algorithm	aes 256;
		hash_algorithm		sha256;
		authentication_method	rsasig;
		lifetime time		30 sec;
		dh_group		16;
	}
}

sainfo anonymous {
	pfs_group			16;
	lifetime time			12 hour;
	encryption_algorithm		aes 256;
	authentication_algorithm	hmac_sha256;
	compression_algorithm		deflate;
}
