Black Box ACS120 Uživatelská příručka stáhnout pdf (Strana 396)

Appendix G - IPSEC

396 BLACK BOX ® Advanced Console Server

The Configuration File

Description

The ipsec.conf file specifies most configuration and control information for the FreeS/WAN

IPsec subsystem. (The major exception is secrets for authentication; ipsec.secrets) Its con-

tents are not security-sensitive unless manual keying is being done for more than just testing,

in which case the encryption/authentication keys in the descriptions for the manually-keyed

connections are very sensitive (and those connection descriptions are probably best kept in a

separate file, via the include facility described below).

The file is a text file, consisting of one or more sections. White space followed by # followed

by anything to the end of the line is a comment and is ignored, as are empty lines which are

not within a section.

A line which contains include and a file name, separated by white space, is replaced by the

contents of that file, preceded and followed by empty lines. If the file name is not a full path-

name, it is considered to be relative to the directory containing the including file. Such inclu-

sions can be nested. Only a single filename may be supplied, and it may not contain white

space, but it may include shell wildcards for example:

include ipsec.*.conf

The intention of the include facility is mostly to permit keeping information on connections,

or sets of connections, separate from the main configuration file. This permits such connec-

tion descriptions to be changed, copied to the other security gateways involved, etc., without

having to constantly extract them from the configuration file and then insert them back into

it. Note the also parameter (described below) which permits splitting a single logical section

(e.g., a connection description) into several actual sections.

A section begins with a line of the form:

type name

where type indicates what type of section follows, and name is an arbitrary name which dis-

tinguishes the section from others of the same type. (Names must start with a letter and may

contain only letters, digits, periods, underscores, and hyphens.) All subsequent non-empty

lines which begin with white space are part of the section; comments within a section must

1 2 ... 391 392 393 394 395 396 397 398 399 400 401 ... 449 450

Žádné komentáře

Black Box ACS120 Uživatelská příručka Strana 396