User guide

Appendix G - IPSEC
400 BLACK BOX ® Advanced Console Server
auto What operation, if any, should be done automatically at IPsec startup; cur-
rently-accepted values are add (signifying an ipsec auto --add), route (sig-
nifying that plus an ipsec auto --route), start (signifying that plus an ipsec
auto --up), and ignore (also the default) (signifying no automatic startup
operation). This parameter is ignored unless the plutoload or plutostart
configuration parameter is set suitably; see the config setup discussion
below.
auth Whether authentication should be done as part of ESP encryption, or sep-
arately using the AH protocol, acceptable values are esp (the default) and
ah.
authby How the two security gateways should authenticate each other. Accept-
able values are secret for shared secrets (the default) and rsasig for RSA
digital signatures.
leftid How the left participant should be identified for authentication. Defaults
to left. Can be an IP address or a fully-qualified domain name preceded by
@ (which is used as a literal string and not resolved).
leftrsasigkey The left participant's public key for RSA signature authentication, in RFC
2537 format. The magic value %none means the same as not specifying a
value (useful to override a default). The value %dnsondemand means the
key is to be fetched from DNS at the time it is needed. The value %dnson-
load means the key is to be fetched from DNS at the time the connection
description is read from ipsec.conf. Currently this is treated as %none if
right=%any or right=%opportunistic. The value %dns is currently treated
as %dnsonload but will change to %dnsondemand in the future. The
identity used for the left participant must be a specific host, not %any or
another magic value. Caution: if two connection descriptions specify dif-
ferent public keys for the same leftid, confusion and madness will ensue.
pfs Whether Perfect Forward Secrecy of keys is desired on the connection's
keying channel. (With PFS, penetration of the key-exchange protocol
does not compromise keys negotiated earlier.) Acceptable values are yes
(the default) and no.