On any line, an unquoted # character introduces a comment. The remainder of that line is ignored. Additionally, on any line, an unquoted // sequence introduces a comment. The remainder of that line is ignored.

There are several types of lexical tokens in the ike.config file:

num

A decimal, hex, or octal number representation is as in 'C'.

IPaddr/prefix/range

An IPv4 or IPv6 address with an optional /NNN suffix, (where NNN is a num) and indicates an address (CIDR) prefix (for example, 10.1.2.0/24). An optional /ADDR suffix (where ADDR is a second IP address) indicates an address / mask pair (for example, 10.1.2.0/255.255.255.0). An optional -ADDR suffix (where ADDR is a second IP address) indicates an inclusive range of addresses (for example, 10.1.2.0-10.1.2.255). The / or - can be surrounded by an arbitrary amount of white space.

in.iked(1M) does not support IPv6.

XXX | YYY | ZZZ

Either the words XXX, YYY, or ZZZ, for example, {yes,no}.

p1-id-type

An IKE phase 1 identity type. IKE phase 1 identity types include:

dn, DN

dns, DNS

fqdn, FQDN

gn, GN

ip, IP

ipv4

ipv4_prefix

ipv4_range

ipv6

ipv6_prefix

ipv6_range

mbox, MBOX

user_fqdn

"string"

A quoted string.

Examples include:"Label foo", or "C=US, OU=Sun Microsystems\\, Inc., N=danmcd@eng.sun.com"

A backslash (\) is an escape character. If the string needs an actual backslash, two must be specified.

cert-sel

A certificate selector, a string which specifies the identities of zero or more certificates. The specifiers can conform to X.509 naming conventions.

A cert-sel can also use various shortcuts to match either subject alternative names, the filename or slot of a certificate in /etc/inet/ike/publickeys, or even the ISSUER. For example:

"SLOT=0" "EMAIL=postmaster@domain.org" "webmaster@domain.org" # Some just work w/o TYPE= "IP=10.0.0.1" "10.21.11.11" # Some just work w/o TYPE= "DNS=www.domain.org" "mailhost.domain.org" # Some just work w/o TYPE= "ISSUER=C=US, O=Sun Microsystems\\, Inc., CN=Sun CA"

Any cert-sel preceded by the character ! indicates a negative match, that is, not matching this specifier. These are the same kind of strings used in ikecert(1M).

ldap-list

A quoted, comma-separated list of LDAP servers and ports.

For example, "ldap1.sun.com", "ldap1.sun.com:389", "ldap1.sun.com:389,ldap2.sun.com".

The default port for LDAP is 389.

parameter-list

A list of parameters.

There are four main types of entries:

• global parameters
• IKE phase 1 transform defaults
• IKE rule defaults
• IKE rules

The global parameter entries are as follows:

cert_root cert-sel

The X.509 distinguished name of a certificate that is a trusted root CA certificate.It must be encoded in a file in the /etc/inet/ike/publickeys directory. It must have a CRL in /etc/inet/ike/crls. Multiple cert_root parameters aggregate.

cert_trust cert-sel

Specifies an X.509 distinguished name of a certificate that is self-signed, or has otherwise been verified as trustworthy for signing IKE exchanges. It must be encoded in a file in /etc/inet/ike/publickeys. Multiple cert_trust parameters aggregate.

ignore_crls

If this keyword is present in the file, in.iked(1M) ignores Certificate Revocation Lists (CRLs) for root CAs (as given in cert_root)

ldap_server ldap-list

A list of LDAP servers to query for certificates. The list can be additive.

proxy string

The string following this keyword must be a URL for an HTTP proxy, for example, http://proxy:8080.

socks string

The string following this keyword must be a URL for a SOCKS proxy, for example, socks://socks-proxy.

use_http

If this keyword is present in the file, in.iked(1M) uses HTTP to retrieve Certificate Revocation Lists (CRLs).

The following IKE phase 1 transform parameters can be prefigured using file-level defaults. Values specified within any given transform override these defaults.

The IKE phase 1 transform defaults are as follows:

p1_lifetime_secs num

The proposed default lifetime, in seconds, of an IKE phase 1 security association (SA).

p1_nonce_len num

The length in bytes of the phase 2 (quick mode) nonce data. This cannot be specified on a per-rule basis.

The following IKE rule parameters can be prefigured using file-level defaults. Values specified within any given rule override these defaults, unless a rule cannot.

p2_nonce_len num

The length in bytes of the phase 2 (quick mode) nonce data. This cannot be specified on a per-rule basis.

local_id_type p1-id-type

The local identity for IKE requires a type. This identity type is reflected in the IKE exchange. The type can be one of the following:

• an IP address (for example, 10.1.1.2)
• DNS name (for example, test.domain.com)
• MBOX RFC 822 name (for example, root@domain.com)
• DNX.509 distinguished name (for example, C=US, O=Sun Microsystems\, Inc., CN=Sun Test cert)

p1_xform '{' parameter-list '}

A phase 1 transform specifies a method for protecting an IKE phase 1 exchange. An initiator offers up lists of phase 1 transforms, and a receiver is expected to only accept such an entry if it matches one in a phase 1 rule. There can be several of these, and they are additive. There must be either at least one phase 1 transform in a rule or a global default phase 1 transform list. In a configuration file without a global default phase 1 transform list and a rule without a phase, transform list is an invalid file. Unless specified as optional, elements in the parameter-list must occur exactly once within a given transform's parameter-list:

oakley_group number

The Oakley Diffie-Hellman group used for IKE SA key derivation. Acceptable values are currently 1 (768-bit), 2 (1024-bit), or 5 (1536-bit).

encr_alg {3des, 3des-cbc, blowfish, des, des-cbc}

An encryption algorithm, as in ipsecconf(1M).

auth_alg {md5, sha, sha1}

An authentication algorithm, as in ipsecconf(1M).

auth_method {preshared, rsa_sig, rsa_encrypt, dss_sig}

The authentication method used for IKE phase 1.

p1_lifetime_secs num

Optional. The lifetime for a phase 1 SA.

p2_lifetime_secs num

If configuring the kernel defaults is not sufficient for different tasks, this parameter can be used on a per-rule basis to set the IPsec SA lifetimes in seconds.

p2_pfs num

The Oakley Diffie-Hellman group used for IPsec SA key derivation. Acceptable values are 0 (do not use Perfect Forward Secrecy for IPsec SAs), 1 (768-bit), 2 (1024-bit), and 5 (1536-bit).

An IKE rule starts with a right-curly-brace ({), ends with a left-curly-brace (}), and has the following parameters in between:

label string

Required parameter. The administrative interface to in.iked looks up phase 1 policy rules with the label as the search string. The administrative interface also converts the label into an index, suitable for an extended ACQUIRE message from PF_KEY - effectively tying IPsec policy to IKE policy in the case of a node initiating traffic. Only one label parameter is allowed per rule.

local_addr <IPaddr/prefix/range>

Required parameter. The local address, address prefix, or address range for this phase 1 rule. Multiple local_addr parameters accumulate within a given rule.

remote_addr <IPaddr/prefix/range>

Required parameter. The remote address, address prefix, or address range for this phase 1 rule. Multiple remote_addr parameters accumulate within a given rule.

local_id_type p1-id-type

Which phase 1 identity type I uses. This is needed because a single certificate can contain multiple values for use in IKE phase 1. Within a given rule, all phase 1 transforms must either use preshared or non-preshared authentication (they cannot be mixed). For rules with preshared authentication, the local_id_type parameter is optional, and defaults to IP. For rules which use non-preshared authentication, the 'local_id_type' parameter is required. Multiple 'local_id_type' parameters within a rule are not allowed.

local_id cert-sel

Disallowed for preshared authentication method; required parameter for non-preshared authentication method. The local identity string or certificate selector. Multiple local_id parameters accumulate within a given rule.

remote_id cert-sel

Disallowed for preshared authentication method; required parameter for non-preshared authentication method. Selector for which remote phase 1 identities are allowed by this rule. Multiple remote_id parameters accumulate within a given rule. If a single empty string ("") is given, then this accepts any remote ID for phase 1. It is recommended that certificate trust chains or address enforcement be configured strictly to prevent a breakdown in security if this value for remote_id is used.

p2_lifetime_secs num

If configuring the kernel defaults is not sufficient for different tasks, this parameter can be used on a per-rule basis to set the IPsec SA lifetimes in seconds.

p2_pfs num

Use perfect forward secrecy for phase 2 (quick mode). If selected, the oakley group specified is used for phase 2 PFS. Acceptable values are 0 (do not use Perfect Forward Secrecy for IPsec SAs), 1 (768-bit), 2 (1024-bit), and 5 (1536-bit).

p1_xform { parameter-list }

A phase 1 transform specifies a method for protecting an IKE phase 1 exchange. An initiator offers up lists of phase 1 transforms, and a receiver is expected to only accept such an entry if it matches one in a phase 1 rule. There can be several of these, and they are additive. There must be either at least one phase 1 transform in a rule or a global default phase 1 transform list. A ike.config file without a global default phase 1transform list and a rule without a phase 1 transform list is an invalid file. Elements within the parameter-list; unless specified as optional, must occur exactly once within a given transform's parameter-list:

oakley_group number

The Oakley Diffie-Hellman group used for IKE SA key derivation. Acceptable values are currently 1 (768-bit), 2 (1024-bit), or 5 (1536-bit).

encr_alg {3des, 3des-cbc, blowfish, des, des-cbc}

An encryption algorithm, as in ipsecconf(1M).

auth_alg {md5, sha, sha1}

An authentication algorithm, as specified in ipseckey(1M).

auth_method {preshared, rsa_sig, rsa_encrypt, dss_sig}

The authentication method used for IKE phase 1.

p1_lifetime_secs num

Optional. The lifetime for a phase 1 SA.

The following is an example of an ike.config file:

 
### BEGINNING OF FILE

### First some global parameters...

### certificate parameters...

# Root certificates. I SHOULD use a full Distinguished Name.
# I must have this certificate in my local filesystem, see ikecert(1m).
cert_root    "C=US, O=Sun Microsystems\\, Inc., CN=Sun CA"

# Explicitly trusted certs that need no signatures, or perhaps self-signed
# ones.  Like root certificates, use full DNs for them for now.
cert_trust    "EMAIL=root@domain.org"

# Where do I send LDAP requests?
ldap_server        "ldap1.domain.org,ldap2.domain.org:389"

## phase 1 transform defaults...

p1_lifetime_secs 14400
p1_nonce_len 20

## Parameters that may also show up in rules.

p1_xform { auth_method preshared oakley_group 5 auth_alg sha
          encr_alg 3des }
p2_pfs 2

### Now some rules...

{
   label "simple inheritor"
   local_id_type ip
   local_addr 10.1.1.1
   remote_addr 10.1.1.2
}

{
   # an index-only rule.  If I'm a receiver, and all I 
   # have are index-only rules, what do I do about inbound IKE requests?
   # Answer:  Take them all!

   label "default rule"
   # Use whatever "host" (e.g. IP address) identity is appropriate
   local_id_type ipv4

   local_addr 0.0.0.0/0
   remote_addr 0.0.0.0/0

   p2_pfs 5

   # Now I'm going to have the p1_xforms
   p1_xform
   {auth_method preshared  oakley_group 5  auth_alg md5  encr_alg blowfish }
   p1_xform
   {auth_method preshared  oakley_group 5  auth_alg md5  encr_alg 3des }
   
   # After said list, another keyword (or a '}') will stop xform parsing.
}

{
   # Let's try something a little more conventional.

   label "host to .80 subnet"
   local_id_type ip
   local_id "10.1.86.51"

   remote_id ""    # Take any, use remote_addr for access control.

   local_addr 10.1.86.51
   remote_addr 10.1.80.0/24

   p1_xform 
   { auth_method rsa_sig  oakley_group 5  auth_alg md5  encr_alg 3des }
   p1_xform
   { auth_method rsa_sig  oakley_group 5  auth_alg md5  encr_alg blowfish }
   p1_xform 
   { auth_method rsa_sig  oakley_group 5  auth_alg sha1  encr_alg 3des }
   p1_xform
   { auth_method rsa_sig  oakley_group 5  auth_alg sha1  encr_alg blowfish }
}
{
   # How 'bout something with a different cert type and name?

   label "punchin-point"
   local_id_type mbox
   local_id "ipsec-wizard@domain.org"

   remote_id "10.5.5.128"

   local_addr 0.0.0.0/0
   remote_addr 10.5.5.128

   p1_xform
   { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish }
}

{
   label "receiver side"

   remote_id "ipsec-wizard@domain.org"

   local_id_type ip
   local_id "10.5.5.128"

   local_addr 10.5.5.128
   remote_addr 0.0.0.0/0

   p1_xform
   { auth_method rsa_sig oakley_group 5 auth_alg md5 encr_alg blowfish }
   # NOTE:  Specifying preshared null-and-voids the remote_id/local_id
   #        fields.
   p1_xform
   { auth_method preshared oakley_group 5 auth_alg md5 encr_alg blowfish}
}