/* 01ike.cdf - IKE configuration file */ /* * Copyright (c) 2006-2007 Wind River Systems, Inc. * * The right to copy, distribute or otherwise make use of this software * may be licensed only pursuant to the terms of an applicable Wind River * license agreement. No license to Wind River intellectual property rights * is granted herein. All rights not licensed by Wind River are reserved * by Wind River. */ /* modification history -------------------- 01g,12may08,brg Removed IPIKE_ALLOW_DUPLICATE_SA. Its an internal configuration variable.((WIND00108854)) 01f,11oct07,jho Fixed bad IPIKE_NAT_PORT default value. 01e,19sep07,rme Added missing backslash 01d,07sep07,rme Replaced SELECTION_IPCOM_FS with SELECT_IPCOM_FS in INCLUDE_INTERNET_KEY_EXCHANGE 01c,06mar07,kch Added support for dynamic address, IPIKE_MAX_EXCHANGES and IPIKE_ALLOW_DUPLICATE_SA configuration parameters (WIND00089895). 01b,07feb07,tkf Add IPIKE dependency on SELECTION_IPCOM_FS. 01a,08jan07,kch Removed trailing ctrl-M characters. */ #ifdef _WRS_CONFIG_COMPONENT_IPIKE Component INCLUDE_INTERNET_KEY_EXCHANGE { NAME Internet Key Exchange (IKE) SYNOPSIS Dynamic keying for security association CONFIGLETTES ipike_config.c CFG_PARAMS IPIKE_SOCK_BUF_SIZE \ IPIKE_MAX_EXCHANGES \ IPIKE_PORT \ IPIKE_NAT_PORT \ IPIKE_NAT_KEEPALIVE \ IPIKE_LIVENESS_TIMER_RESOLUTION \ IPIKE_RESEND_DELAY \ IPIKE_CONFIG_FILE_NAME \ IPIKE_CONFIG_FILE_PATH \ IPIKE_NONCE_SIZE \ IPIKE_CREATE_DEFAULT_CONFIG_FILE \ IPIKE_FLUSH_STARTUP \ IPIKE_FLUSH_SHUTDOWN \ IPIKE_FLUSH_RECONFIGURE \ IPIKE_SOFT_TO_HARD_TIME \ IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4 \ IPIKE_DYNAMIC_ADDRESS_POOL_DNS4 \ IPIKE_DYNAMIC_ADDRESS_MODE \ IPIKE_DYNAMIC_ADDRESS_ANYFLOW \ IPIKE_DYNAMIC_ADDRESS_HOMEADDR \ IPIKE_REKEY_FUZZINESS \ IPIKE_USE_HASH_AND_URL \ IPIKE_HTTP_REQUEST_TIMEOUT \ IPIKE_HTTP_RESPONSE_BUF_SIZE \ IPIKE_MAX_IKE_SA_NUM \ IPIKE_MAX_IPSEC_SA_NUM \ IPIKE_MAX_MESSAGE_SIZE \ MODULES ipike.o REQUIRES INCLUDE_IPNET_SOCKET INCLUDE_IPCRYPTO \ SELECT_IPCOM_FS INCLUDE_IP_SECURITY \ INCLUDE_IPCOM_USE_KEY_DB } Parameter IPIKE_SOCK_BUF_SIZE { NAME Socket buffer size SYNOPSIS ISAKMP socket buffer size (in bytes), this is the largest ISAKMP message the IKE daemon can send and receive. TYPE string DEFAULT "10000" } Parameter IPIKE_MAX_EXCHANGES { NAME Maximum number of active exchanges SYNOPSIS The maximum number of active exchanges, ISAKMP packets for new \ exchanges will be dropped when the maximum is reached. \ Set to 0 to allow infinite number of exchanges. TYPE string DEFAULT "32" } Parameter IPIKE_PORT { NAME IKE Port SYNOPSIS Specifies the UDP port on which to listen for ISAKMP packets. Should be 500 in most cases. TYPE string DEFAULT "500" } Parameter IPIKE_NAT_PORT { NAME IKE NAT-T port SYNOPSIS Specifies the UDP port on which to listen for ISAKMP NATTraversal packets. Must be 4500 to interoperate with other clients. TYPE string DEFAULT "0" } Parameter IPIKE_NAT_KEEPALIVE { NAME Time between NAT keepalive messages SYNOPSIS Specifies the number of seconds between keep alive packets when NAT-Traversal is used. TYPE string DEFAULT "20" } Parameter IPIKE_RESEND_DELAY { NAME IKE message resend delay SYNOPSIS The time (in seconds) the IKE daemon will wait before doing the \ first resend of a packet. IKE will wait two times this value between \ the first and second resend, three times the value until the \ third resend, etc. TYPE string DEFAULT "2" } Parameter IPIKE_LIVENESS_TIMER_RESOLUTION { NAME IKE liveness timer resolution SYNOPSIS The time period (in seconds) in which the IKE daemon will traverse \ all IPsec SA entries and perform liveness check (any packets received). \ A lower value will allow faster detection of dead remote peers but use more \ CPU resources. A value of 0 will disable the timer and liveness checking. TYPE string DEFAULT "10" } Parameter IPIKE_CONFIG_FILE_NAME { NAME Name of the IKE config file SYNOPSIS The name of the file that will be used to configure the IKE daemon on startup. TYPE string DEFAULT "ike.cfg" } Parameter IPIKE_CONFIG_FILE_PATH { NAME Path to the IKE config file SYNOPSIS The path the IKE daemon will use to locate the configuration file. TYPE string DEFAULT "/ram/" } Parameter IPIKE_NONCE_SIZE { NAME Size of created nonces SYNOPSIS The size (in bytes) of the nonce (random number) that the IKE \ daemon will generate during phase 1 exchange. Must be between \ 8 and 256 (inclusive) bytes. TYPE string DEFAULT "64" } Parameter IPIKE_CREATE_DEFAULT_CONFIG_FILE { NAME Create IKE config file SYNOPSIS IPIKE will create a default configuration file for acting as a \ responder using preshared secret if this variable is set to 1 \ and there is no configuration file with the name specified by \ ipike.filename present. TYPE string DEFAULT "1" } Parameter IPIKE_FLUSH_STARTUP { NAME Flush keys at startup SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at startup. TYPE string DEFAULT "0" } Parameter IPIKE_FLUSH_SHUTDOWN { NAME Flush keys at shutdown SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys at shutdown. TYPE string DEFAULT "0" } Parameter IPIKE_FLUSH_RECONFIGURE { NAME Flush keys on reconfigure SYNOPSIS This flag is used to indicate to the IKE daemon to flush the keys when reconfigured. TYPE string DEFAULT "0" } Parameter IPIKE_SOFT_TO_HARD_TIME { NAME IPSec SA soft to hard time SYNOPSIS The IPSec SA soft timeout expires this many seconds earlier than the hard timeout. TYPE string DEFAULT "300" } Parameter IPIKE_DYNAMIC_ADDRESS_POOL_NETWORK4 { NAME Dynamic address pool network4 SYNOPSIS This string is used to specify ip network for IPv4 dynamic address pool (responder). TYPE string DEFAULT "10.1.111.1/24" } Parameter IPIKE_DYNAMIC_ADDRESS_POOL_DNS4 { NAME Dynamic address pool dns4 SYNOPSIS This string is used to specify dns ip address for IPv4 dynamic address pool (responder). TYPE string DEFAULT "10.1.1.1" } Parameter IPIKE_DYNAMIC_ADDRESS_MODE { NAME Dynamic address mode SYNOPSIS This string is used to specify dynamic address mode for IKE version 1 protocol (initiator). TYPE string DEFAULT "1" } Parameter IPIKE_DYNAMIC_ADDRESS_ANYFLOW { NAME Dynamic address anyflow SYNOPSIS Set this flag to 1 to make the responder traffic selector match any address in case of dynamic addresses with IKEv2 (responder). TYPE string DEFAULT "0" } Parameter IPIKE_DYNAMIC_ADDRESS_HOMEADDR { NAME Dynamic address home address SYNOPSIS Set this flag to 1 to add the initiator's dynamic address as a home address (initiator). \ The home address is the preferred source address. TYPE string DEFAULT "0" } Parameter IPIKE_REKEY_FUZZINESS { NAME IKE rekey fuzziness SYNOPSIS The rekey fuzziness is used for avoiding situations where both IKE peers initiate a rekey exchange simultaneously. \ A value of 20 will delay the rekey timer with a random amount of time between 0 and 20 seconds. The rekey fuzziness applies on \ both IKE SA and IPsec SA rekey. A value of 0 disables the fuzziness. TYPE string DEFAULT "20" } Parameter IPIKE_USE_HASH_AND_URL { NAME Enable Hash and URL SYNOPSIS The Hash and URL feature allows IKEv2 peers to send and receive a hash digest of a certificate followed by a URL \ pointing out the actual location of the certificate. This allows IKE messages to be small and IP fragmentation can be avoided \ since certificates are fetched using HTTP instead. The feature is disabled by default since there is a potential \ security risk of accepting a URL from an unauthenticated peer, set this flag to 1 to enable support for it. TYPE string DEFAULT "0" } Parameter IPIKE_HTTP_REQUEST_TIMEOUT { NAME IKE HTTP request timeout SYNOPSIS The maximum number of seconds the IKE daemon will wait for an HTTP response. TYPE string DEFAULT "5" } Parameter IPIKE_HTTP_RESPONSE_BUF_SIZE { NAME IKE HTTP response buffer size SYNOPSIS This value controls the largest possible HTTP response the IKE dameon can receive. TYPE string DEFAULT "4096" } Parameter IPIKE_MAX_IKE_SA_NUM { NAME Maximum number of IKE SAs SYNOPSIS Specifies the maximum number of concurrent IKE SAs that can be established. \ Set to 0 to allow infinite number of IKE SAs. TYPE string DEFAULT "0" } Parameter IPIKE_MAX_IPSEC_SA_NUM { NAME Maximum number of IPsec SAs SYNOPSIS Specifies the maximum number of concurrent IPsec SAs that can be established. \ Set to 0 to allow infinite number of IPsec SAs. TYPE string DEFAULT "0" } Parameter IPIKE_MAX_MESSAGE_SIZE { NAME Maximum size of an IKE message SYNOPSIS Specifies the maximum size of an IKE message. This restriction will be applied \ on both outgoing and incoming IKE traffic. Set to 0 to for unlimited size (limited by the maximum UDP packet size). TYPE string DEFAULT "0" } #endif