1.\" $OpenBSD: iked.conf.5,v 1.99 2024/11/04 02:44:28 dlg Exp $ 2.\" 3.\" Copyright (c) 2010 - 2014 Reyk Floeter <reyk@openbsd.org> 4.\" Copyright (c) 2004 Mathieu Sauve-Frankel All rights reserved. 5.\" 6.\" Permission to use, copy, modify, and distribute this software for any 7.\" purpose with or without fee is hereby granted, provided that the above 8.\" copyright notice and this permission notice appear in all copies. 9.\" 10.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES 11.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 12.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR 13.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 14.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 15.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 16.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 17.\" 18.Dd $Mdocdate: November 4 2024 $ 19.Dt IKED.CONF 5 20.Os 21.Sh NAME 22.Nm iked.conf 23.Nd IKEv2 configuration file 24.Sh DESCRIPTION 25.Nm 26is the configuration file for 27.Xr iked 8 , 28the Internet Key Exchange version 2 (IKEv2) daemon for IPsec. 29IPsec itself is a pair of protocols: 30Encapsulating Security Payload (ESP), 31which provides integrity and confidentiality; 32and Authentication Header (AH), 33which provides integrity. 34The IPsec protocol itself is described in 35.Xr ipsec 4 . 36.Pp 37In its most basic form, a flow is established between hosts and/or 38networks, and then Security Associations (SA) are established, 39which detail how the desired protection will be achieved. 40IPsec uses flows to determine whether to apply security services to an 41IP packet or not. 42.Xr iked 8 43is used to set up flows and establish SAs automatically, 44by specifying 45.Sq ikev2 46policies in 47.Nm 48(see 49.Sx AUTOMATIC KEYING POLICIES , 50below). 51.Pp 52Alternative methods of setting up flows and SAs are also possible 53using manual keying or automatic keying using the older ISAKMP/Oakley 54a.k.a. IKEv1 protocol. 55Manual keying is not recommended, but can be convenient for quick 56setups and testing. 57See 58.Xr ipsec.conf 5 59and 60.Xr isakmpd 8 61for more information about manual keying and ISAKMP support. 62.Sh IKED.CONF FILE FORMAT 63.Nm 64is divided into three main sections: 65.Bl -tag -width xxxx 66.It Sy Macros 67User-defined macros may be defined and used later, simplifying the 68configuration file. 69.It Sy Global Configuration 70Global settings for 71.Xr iked 8 . 72.It Sy Automatic Keying Policies 73Policies to set up IPsec flows and SAs automatically. 74.El 75.Pp 76Lines beginning with 77.Sq # 78and empty lines are regarded as comments, 79and ignored. 80Lines may be split using the 81.Sq \e 82character. 83.Pp 84Argument names not beginning with a letter, digit, or underscore 85must be quoted. 86.Pp 87Addresses can be specified in CIDR notation (matching netblocks), 88as symbolic host names, interface names, or interface group names. 89.Pp 90Additional configuration files can be included with the 91.Ic include 92keyword, for example: 93.Bd -literal -offset indent 94include "/etc/macros.conf" 95.Ed 96.Pp 97Certain parameters can be expressed as lists, in which case 98.Xr iked 8 99generates all the necessary flow combinations. 100For example: 101.Bd -literal -offset indent 102ikev2 esp proto { tcp, udp } \e 103 from 192.168.1.1 to 10.0.0.18 \e 104 peer 192.168.10.1 105.Ed 106.Sh MACROS 107Macros can be defined that will later be expanded in context. 108Macro names must start with a letter, digit, or underscore, 109and may contain any of those characters. 110Macro names may not be reserved words (for example 111.Ic flow , 112.Ic from , 113.Ic esp ) . 114Macros are not expanded inside quotes. 115.Pp 116For example: 117.Bd -literal -offset indent 118remote_gw = "192.168.3.12" 119ikev2 esp from 192.168.7.0/24 to 192.168.8.0/24 peer $remote_gw 120.Ed 121.Sh GLOBAL CONFIGURATION 122Here are the settings that can be set globally: 123.Bl -tag -width xxxx 124.It Ic set active 125Set 126.Xr iked 8 127to global active mode. 128In active mode the per-policy 129.Ar mode 130setting is respected. 131.Xr iked 8 132will initiate policies set to 133.Ar active 134and wait for incoming requests for policies set to 135.Ar passive . 136This is the default. 137.It Ic set passive 138Set 139.Xr iked 8 140to global passive mode. 141In passive mode no packets are sent to peers and no connections are 142initiated by 143.Xr iked 8 , 144even for 145.Ar active 146policies. 147This option is used for setups using 148.Xr sasyncd 8 149and 150.Xr carp 4 151to provide redundancy. 152.Xr iked 8 153will run in passive mode until sasyncd has determined that the host 154is the master and can switch to active mode. 155.It Ic set couple 156Load the negotiated security associations (SAs) and flows into the kernel. 157This is the default. 158.It Ic set decouple 159Don't load the negotiated SAs and flows from the kernel. 160This mode is only useful for testing and debugging. 161.It Ic set dpd_check_interval Ar time 162Specify the liveness check interval, in seconds. 163Setting 164.Ar time 165to 0 disables DPD. 166The default value is 60 seconds. 167.It Ic set enforcesingleikesa 168Allow only a single active IKE SA for each 169.Ic dstid . 170When a new SA with the same 171.Ic dstid 172is established, it replaces the old SA. 173.It Ic set noenforcesingleikesa 174Don't limit the number of IKE SAs per 175.Ic dstid . 176This is the default. 177.It Ic set fragmentation 178Enable IKEv2 Message Fragmentation (RFC 7383) support. 179This allows IKEv2 to operate in environments that might block IP fragments. 180.It Ic set nofragmentation 181Disables IKEv2 Message Fragmentation support. 182This is the default. 183.It Ic set mobike 184Enable MOBIKE (RFC 4555) support. 185This is the default. 186MOBIKE allows the peer IP address to be changed for IKE and IPsec SAs. 187Currently 188.Xr iked 8 189only supports MOBIKE when acting as a responder. 190.It Ic set nomobike 191Disables MOBIKE support. 192.It Ic set cert_partial_chain 193Allow partial certificate chain if at least one certificate is a trusted CA from 194.Pa /etc/iked/ca/ . 195.It Ic set ocsp Ar URL Op Ic tolerate Ar time Op Ic maxage Ar time 196Enable OCSP and set the fallback URL of the OCSP responder. 197This fallback will be used if the trusted CA from 198.Pa /etc/iked/ca/ 199does not have an OCSP-URL extension. 200The matching responder certificates have to be placed in 201.Pa /etc/iked/ocsp/responder.crt . 202.Pp 203The optional 204.Ic tolerate 205parameter specifies how much the OCSP response attribute 206.Sq thisUpdate 207may be in the future and how much 208.Sq nextUpdate 209may be in the past, with respect to the local time. 210The optional 211.Ic maxage 212parameter specifies how much 213.Sq thisUpdate 214may be in the past. 215If 216.Ic tolerate 217is set to 0 then the times are not verified at all. 218This is the default setting. 219.It Ic set vendorid 220Send OpenIKED Vendor ID payload. 221This is the default. 222.It Ic set novendorid 223Don't send a Vendor ID payload. 224.It Ic user Ar name password 225.Xr iked 8 226supports user-based authentication by tunneling the Extensible 227Authentication Protocol (EAP) over IKEv2. 228In its most basic form, the users will be authenticated against a 229local, integrated password database that is configured with the 230.Ic user 231lines in 232.Nm 233and the 234.Ar name 235and 236.Ar password 237arguments. 238The password has to be specified in plain text which is 239required to support different challenge-based EAP methods like 240EAP-MD5 or EAP-MSCHAPv2. 241.El 242.Sh AUTOMATIC KEYING POLICIES 243This section is used to configure policies that will be used by 244.Xr iked 8 245to set up flows and SAs automatically. 246Some examples of setting up automatic keying: 247.Bd -literal -offset 3n 248# Set up a VPN: 249# First between the gateway machines 192.168.3.1 and 192.168.3.2 250# Second between the networks 10.1.1.0/24 and 10.1.2.0/24 251ikev2 esp from 192.168.3.1 to 192.168.3.2 252ikev2 esp from 10.1.1.0/24 to 10.1.2.0/24 peer 192.168.3.2 253.Ed 254.Pp 255For incoming connections from remote peers, the policies are evaluated 256in sequential order, from first to last. 257The last matching policy decides what action is taken; if no policy matches 258the connection, the default action is to ignore the connection attempt or 259to use the 260.Ar default 261policy, if set. 262See the 263.Sx EXAMPLES 264section for a detailed example of the policy evaluation. 265.Pp 266The first time an IKEv2 connection matches a policy, an IKE SA is 267created; for subsequent packets the connection is identified by the 268IKEv2 parameters that are stored in the SA without evaluating any 269policies. 270After the connection is closed or times out, the IKE SA is 271automatically removed. 272.Pp 273The commands are as follows: 274.Bl -tag -width xxxx -compact 275.It Xo 276.Ic ikev2 277.Op Ar name 278.Xc 279The mandatory 280.Ic ikev2 281keyword will identify an IKEv2 automatic keying policy. 282.Ar name 283is an optional arbitrary string identifying the policy. 284The name should only occur once in 285.Nm 286or any included files. 287If omitted, 288a name will be generated automatically for the policy. 289.Pp 290.It Op Ar eval 291The 292.Ar eval 293option modifies the policy evaluation for this policy. 294It can be one of 295.Ar quick , 296.Ar skip 297or 298.Ar default . 299If a new incoming connection matches a policy with the 300.Ar quick 301option set, that policy is considered the last matching policy, 302and evaluation of subsequent policies is skipped. 303The 304.Ar skip 305option will disable evaluation of this policy for incoming connections. 306The 307.Ar default 308option sets the default policy and should only be specified once. 309.Pp 310.It Op Ar mode 311.Ar mode 312specifies the IKEv2 mode to use: 313one of 314.Ar passive 315or 316.Ar active . 317When 318.Ar passive 319is specified, 320.Xr iked 8 321will not immediately start negotiation of this tunnel, but wait for an incoming 322request from the remote peer. 323When 324.Ar active 325is specified, negotiation will be started at once. 326If omitted, 327.Ar passive 328mode will be used. 329.Pp 330.It Op Ar ipcomp 331The keyword 332.Ar ipcomp 333specifies that 334.Xr ipcomp 4 , 335the IP Payload Compression protocol, is negotiated in addition to encapsulation. 336The optional compression is applied before packets are encapsulated. 337IPcomp must be enabled in the kernel: 338.Pp 339.Dl # sysctl net.inet.ipcomp.enable=1 340.Pp 341.It Op Ar tmode 342.Ar tmode 343describes the encapsulation mode to be used. 344Possible modes are 345.Ar tunnel 346and 347.Ar transport ; 348the default is 349.Ar tunnel . 350.Pp 351.It Op Ar natt 352.Ar natt 353forces negotiation of NAT-Traversal after the initial handshake. 354.Pp 355.It Op Ar encap 356.Ar encap 357specifies the encapsulation protocol to be used. 358Possible protocols are 359.Ar esp 360and 361.Ar ah ; 362the default is 363.Ar esp . 364.Pp 365.It Op Ar af 366This policy only applies to endpoints of the specified address family 367which can be either 368.Ar inet 369or 370.Ar inet6 . 371This only matters for IKEv2 endpoints and does not 372restrict the traffic selectors to negotiate flows with different 373address families, e.g. IPv6 flows negotiated by IPv4 endpoints. 374.Pp 375.It Xo 376.Ic proto Ar protocol 377.Xc 378.It Xo 379.Ic proto 380.Ic { Ar protocol ... Ic } 381.Xc 382The optional 383.Ic proto 384parameter restricts the flow to a specific IP protocol. 385Common protocols are 386.Xr icmp 4 , 387.Xr tcp 4 , 388and 389.Xr udp 4 . 390For a list of all the protocol name to number mappings used by 391.Xr iked 8 , 392see the file 393.Pa /etc/protocols . 394.Pp 395Multiple 396.Ar protocol 397entries can be specified, separated by commas or whitespace, 398if enclosed in curly brackets: 399.Bd -literal -offset indent 400proto { tcp, udp } 401.Ed 402.Pp 403.It Ic rdomain Ar number 404Specify a different routing domain for unencrypted traffic. 405The resulting IPsec SAs will match outgoing packets in the specified 406.Ic rdomain Ar number 407and move the encrypted packets to the rdomain the 408.Xr iked 8 409instance is running in. 410Vice versa, incoming 411.Xr ipsec 4 412traffic is moved to 413.Ic rdomain Ar number 414after decryption. 415.Pp 416.It Xo 417.Ic from Ar src 418.Op Ic port Ar sport 419.Op Pq Ar srcnat 420.Ic to Ar dst 421.Op Ic port Ar dport 422.Xc 423Specify one or more traffic selectors for this policy which will be 424used to negotiate the IPsec flows between the IKEv2 peers. 425During the negotiation, the peers may decide to narrow a flow to a 426subset of the configured traffic selector networks to match the 427policies on each side. 428.Pp 429Each traffic selector will apply for packets with source address 430.Ar src 431and destination address 432.Ar dst . 433If the 434.Ar src 435argument specifies a fictional source ID, 436the 437.Ar srcnat 438parameter can be used to specify the actual source address. 439This can be used in outgoing NAT/BINAT scenarios as described below. 440The keyword 441.Ar any 442will match any address (i.e. 0.0.0.0/0 and ::/0). 443If the 444.Ic config address 445option is specified, the 446.Ar dynamic 447keyword can be used to create flows from or to the dynamically 448assigned address. 449.Pp 450The optional 451.Ic port 452modifiers restrict the traffic selectors to the specified ports. 453They are only valid in conjunction with the 454.Xr tcp 4 455and 456.Xr udp 4 457protocols. 458Ports can be specified by number or by name. 459For a list of all port name to number mappings used by 460.Xr ipsecctl 8 , 461see the file 462.Pa /etc/services . 463.Pp 464.It Ic local Ar localip Ic peer Ar remote 465The 466.Ic local 467parameter specifies the address or FQDN of the local endpoint. 468Unless the gateway is multi-homed or uses address aliases, 469this option is generally not needed. 470.Pp 471The 472.Ic peer 473parameter specifies the address or FQDN of the remote endpoint. 474For host-to-host connections where 475.Ar dst 476is identical to 477.Ar remote , 478this option is generally not needed as it will be set to 479.Ar dst 480automatically. 481If it is not specified or if the keyword 482.Ar any 483is given, the default peer is used. 484.Pp 485.It Xo 486.Ic ikesa 487.Ic auth Ar algorithm 488.Ic enc Ar algorithm 489.Ic prf Ar algorithm 490.Ic group Ar group 491.Xc 492These parameters define the mode and cryptographic transforms to be 493used for the IKE SA negotiation, also known as phase 1. 494The IKE SA will be used to authenticate the machines and to set up an 495encrypted channel for the IKEv2 protocol. 496.Pp 497Possible values for 498.Ic auth , 499.Ic enc , 500.Ic prf , 501.Ic group , 502and the default proposals are described below in 503.Sx CRYPTO TRANSFORMS . 504If omitted, 505.Xr iked 8 506will use the default proposals for the IKEv2 protocol. 507.Pp 508The keyword 509.Ic ikesa 510can be used multiple times as a delimiter between IKE SA proposals. 511The order of the proposals depend on the order in the configuration. 512The keywords 513.Ic auth , 514.Ic enc , 515.Ic prf 516and 517.Ic group 518can be used multiple times within a single proposal to configure 519multiple crypto transforms. 520.Pp 521.It Xo 522.Ic childsa 523.Ic auth Ar algorithm 524.Ic enc Ar algorithm 525.Ic group Ar group 526.Ic esn 527.Xc 528These parameters define the cryptographic transforms to be used for 529the Child SA negotiation, also known as phase 2. 530Each Child SA will be used to negotiate the actual IPsec SAs. 531The initial Child SA is always negotiated with the initial IKEv2 key 532exchange; additional Child SAs may be negotiated with additional 533Child SA key exchanges for an established IKE SA. 534.Pp 535Possible values for 536.Ic auth , 537.Ic enc , 538.Ic group , 539.Ic esn , 540and the default proposals are described below in 541.Sx CRYPTO TRANSFORMS . 542If omitted, 543.Xr iked 8 544will use the default proposals for the ESP or AH protocol. 545.Pp 546The 547.Ic group 548option will only be used to enable Perfect Forward Secrecy (PFS) 549for additional Child SAs exchanges that are not part of the initial 550key exchange. 551.Pp 552The keyword 553.Ic childsa 554can be used multiple times as a delimiter between Child SA proposals. 555The order of the proposals depend on the order in the configuration. 556The keywords 557.Ic auth , 558.Ic enc 559and 560.Ic group 561can be used multiple times within a single proposal to configure 562multiple crypto transforms. 563.Pp 564.It Ic srcid Ar string Ic dstid Ar string 565.Ic srcid 566defines an ID of type 567.Dq FQDN , 568.Dq ASN1_DN , 569.Dq IPV4 , 570.Dq IPV6 , 571or 572.Dq UFQDN 573that will be used by 574.Xr iked 8 575as the identity of the local peer. 576If the argument is an email address (reyk@example.com), 577.Xr iked 8 578will use UFQDN as the ID type. 579The ASN1_DN type will be used if the string starts with a slash 580.Sq / 581(/C=DE/../CN=10.0.0.1/emailAddress=reyk@example.com). 582If the argument is an IPv4 address or a compressed IPv6 address, 583the ID types IPV4 or IPV6 will be used. 584Anything else is considered to be an FQDN. 585.Pp 586If 587.Ic srcid 588is omitted, 589the default is to use the hostname of the local machine, 590see 591.Xr hostname 1 592to set or print the hostname. 593.Pp 594.Ic dstid 595is similar to 596.Ic srcid , 597but instead specifies the ID to be used 598by the remote peer. 599.Pp 600.It Ic ikelifetime Ar time 601The optional 602.Ic ikelifetime 603parameter defines the IKE SA expiration timeout by the 604.Ar time 605SA was created. 606A zero value disables active IKE SA rekeying. 607This is the default. 608.Pp 609The accepted format of the 610.Ar time 611specification is described below. 612.Pp 613.It Ic lifetime Ar time Op Ic bytes Ar bytes 614The optional 615.Ic lifetime 616parameter defines the Child SA expiration timeout by the 617.Ar time 618SA was in use and by the number of 619.Ar bytes 620that were processed using the SA. 621Default values are 3 hours and 4 gigabytes which means that SA will be 622rekeyed before reaching the time limit or 4 gigabytes of data 623will pass through. 624Zero values disable rekeying. 625.Pp 626Several unit specifiers are recognized (ignoring case): 627.Ql m 628and 629.Ql h 630for minutes and hours, and 631.Ql K , 632.Ql M 633and 634.Ql G 635for kilo-, mega- and gigabytes accordingly. 636.Pp 637Rekeying must happen at least several times a day as 638IPsec security heavily depends on frequent key renewals. 639.Pp 640.It Op Ar ikeauth 641Specify a method to be used to authenticate the remote peer. 642.Xr iked 8 643will automatically determine a method based on public keys or certificates 644configured for the peer. 645.Ar ikeauth 646can be used to override this behaviour. 647Non-psk modes will require setting up certificates and RSA or ECDSA public 648keys; see 649.Xr iked 8 650for more information. 651.Pp 652.Bl -tag -width $domain -compact -offset indent 653.It Ic eap Ar type 654Use EAP to authenticate the initiator. 655Currently 656.Ar MSCHAP-V2 657or 658.Ar RADIUS 659is supported for the EAP 660.Ar type . 661The responder will use RSA public key authentication. 662To use RADIUS for EAP, 663at least one RADIUS server should be configured. 664See the 665.Sx RADIUS 666section for RADIUS support. 667.It Ic ecdsa256 668Use ECDSA with a 256-bit elliptic curve key and SHA2-256 for authentication. 669.It Ic ecdsa384 670Use ECDSA with a 384-bit elliptic curve key and SHA2-384 for authentication. 671.It Ic ecdsa521 672Use ECDSA with a 521-bit elliptic curve key and SHA2-512 for authentication. 673.It Ic psk Ar string 674Use a pre-shared key 675.Ar string 676or hex value (starting with 0x) for authentication. 677.It Ic psk file Ar path 678Use a pre-shared hex key (without leading 0x) read from 679.Ar path 680for authentication. 681.It Ic rfc7427 682Only use RFC 7427 signatures for authentication. 683RFC 7427 signatures currently only support SHA2-256 as the hash. 684.It Ic rsa 685Use RSA public key authentication with SHA1 as the hash. 686.El 687.Pp 688The default is to allow any signature authentication. 689.Pp 690.It Cm config Ar option address 691.It Cm request Ar option address 692Request or serve one or more optional configuration payloads (CP). 693The configuration 694.Ar option 695can be one of the following with the expected address format: 696.Pp 697.Bl -tag -width Ds -compact -offset indent 698.It Ic address Ar address 699Assign a static address on the internal network. 700.It Ic address Ar address/prefix 701Assign a dynamic address on the internal network. 702The address will be assigned from an address pool with the size specified by 703.Ar prefix . 704.It Ic netmask Ar netmask 705The IPv4 netmask of the internal network. 706.It Ic name-server Ar address 707The DNS server address within the internal network. 708.It Ic netbios-server Ar address 709The NetBIOS name server (WINS) within the internal network. 710This option is provided for compatibility with legacy clients. 711.It Ic dhcp-server Ar address 712The address of an internal DHCP server for further configuration. 713.It Ic protected-subnet Ar address/prefix 714The address of an additional IPv4 or IPv6 subnet reachable over the 715gateway. 716This option is used to notify the peer of a subnet behind the gateway (that 717might require a second SA). 718Networks specified in this SA's "from" or "to" options do not need to be 719included. 720.It Ic access-server Ar address 721The address of an internal remote access server. 722.El 723.Pp 724.It Ic iface Ar interface 725Enable automatic network configuration as initiator. 726Received addresses, routes and nameservers will be installed on the specified 727.Ar interface . 728.Pp 729.It Ic tag Ar string 730Add a 731.Xr pf 4 732tag to all packets of IPsec SAs created for this connection. 733This will allow matching packets for this connection by defining 734rules in 735.Xr pf.conf 5 736using the 737.Cm tagged 738keyword. 739.Pp 740The following variables can be used in tags to include information 741from the remote peer on runtime: 742.Pp 743.Bl -tag -width $domain -compact -offset indent 744.It Ar $id 745The 746.Ic dstid 747that was proposed by the remote peer to identify itself. 748It will be expanded to 749.Ar id-value , 750e.g.\& 751.Ar FQDN/foo.example.com . 752To limit the size of the derived tag, 753.Xr iked 8 754will extract the common name 755.Sq CN= 756from ASN1_DN IDs, for example 757.Ar ASN1_ID//C=DE/../CN=10.1.1.1/.. 758will be expanded to 759.Ar 10.1.1.1 . 760.It Ar $eapid 761For a connection using EAP, the identity (username) used by the remote peer. 762.It Ar $domain 763Extract the domain from IDs of type FQDN, UFQDN or ASN1_DN. 764.It Ar $name 765The name of the IKEv2 policy that was configured in 766.Nm 767or automatically generated by 768.Xr iked 8 . 769.El 770.Pp 771For example, if the ID is 772.Ar FQDN/foo.example.com 773or 774.Ar UFQDN/user@example.com , 775.Dq ipsec-$domain 776expands to 777.Dq ipsec-example.com . 778The variable expansion for the 779.Ar tag 780directive occurs only at runtime (not when the file is parsed) 781and must be quoted, or it will be interpreted as a macro. 782.Pp 783.It Ic tap Ar interface 784Send the decapsulated IPsec traffic to the specified 785.Xr enc 4 786.Ar interface 787instead of 788.Ar enc0 789for filtering and monitoring. 790The traffic will be blocked if the specified 791.Ar interface 792does not exist. 793.El 794.Sh RADIUS CONFIGURATION 795The configuration options for RADIUS are as follows: 796.Bl -tag -width xxxx 797.It Ic radius config Oo Ar af Oc Ar option Oo Ar vendor Oc Ar attr 798Once RADIUS authentication has succeeded, 799.Xr iked 8 800uses the RADIUS attributes containing the response from the RADIUS server to 801construct IKEv2 configuration payloads (CP). 802This configuration option defines a mapping from a RADIUS attribute to an IKE 803CP with the following parameters: 804.Pp 805.Bl -tag -width "vendor attr" -compact 806.It Op Ar af 807Specify either 808.Cm inet 809or 810.Cm inet6 811for the address family of the IKE CP option. 812.It Ar option 813Specify an IKE CP option. 814Choose from 815.Sx AUTOMATIC KEYING POLICIES 816config options 817.Po 818.Cm address , 819.Cm netmask , 820.Cm name-server , 821.Cm netbios-server , 822.Cm dhcp-server , 823and 824.Cm access-server 825.Pc 826or use 827.Cm none 828to disable the existing or default mapping. 829.It Ar attr 830For a standard RADIUS attribute, 831specify its Attribute-Type for 832.Ar attr . 833.It Ar vendor Ar attr 834For a vendor specific RADIUS attribute, 835specify its Vendor-ID for 836.Ar vendor 837and the Attribute-Type for 838.Ar attr . 839.El 840.Pp 841By default, 842.Xr iked 8 843uses the following attributes for the options: 844.Bl -column "inet6 netbios-server" "Vendor" "Type" "MS-Secondary-NBNS-Server" \ 845-offset "XX" 846.It Em "Option" Ta Em "Vendor" Ta Em "Type" Ta Em "Attribute Name" 847.It Li "inet address" Ta "" Ta "8" Ta "Framed-IP-Address" 848.It Li "inet netmask" Ta "" Ta "9" Ta "Framed-IP-Netmask" 849.It Li "inet name-server" Ta "0x137" Ta "28" Ta "MS-Primary-DNS-Server" 850.It Li "inet name-server" Ta "0x137" Ta "29" Ta "MS-Secondary-DNS-Server" 851.It Li "inet netbios-server" Ta "0x137" Ta "30" Ta "MS-Primary-NBNS-Server" 852.It Li "inet netbios-server" Ta "0x137" Ta "31" Ta "MS-Secondary-NBNS-Server" 853.El 854.It Ic radius Oo Ic accounting Oc Ic server Ar address Oo port Ar number Oc \ 855secret Ar secret 856Specify the RADIUS server's IP address and the shared secret with the server. 857For a RADIUS accounting server, 858use the 859.Cm accounting 860keyword. 861Optionally specify the port number, 862otherwise the default port number, 8631812 for authentication or 8641813 for accounting, 865is used as the default. 866.It Ic radius Oo Ic accounting Oc Ic max-tries Ar number 867Specify the maximum number of retransmissions for a server. 868.Xr iked 8 869will retransmit 2, 6, 14, 22, 30 seconds after the first transmission 870and subsequent retransmissions will occur every 8 seconds. 871If the number of retransmissions per server reaches this value, 872the current server is marked as failed, 873and the next server is used for subsequent requests. 874For RADIUS accounting requests, 875use the 876.Cm accounting 877keyword. 878The default value is 3. 879.It Ic radius Oo Ic accounting Oc Ic max-failovers Ar number 880If a positive number is specified, 881.Xr iked 8 882will failover to the next server when the current server is marked 883.Dq fail . 884This key and value specifies the maximum number of failovers. 885For RADIUS accounting requests, 886use the 887.Cm accounting 888keyword. 889The default value is 0. 890.It Ic radius dae listen on Ar address Oo port Ar number Oc 891Specify the local 892.Ar address 893.Xr iked 8 894should listen on for the Dynamic Authorization Extensions 895.Pq DAE, RFC 5176 896requests. 897Optionally specify a port 898.Ar number ; 899the default port number is 3799. 900.It Ic radius dae client Ar address Ic secret Ar secret 901Specify an 902.Ar address 903for a DAE client and 904.Ar secret . 905.El 906.Sh PACKET FILTERING 907IPsec traffic appears unencrypted on the 908.Xr enc 4 909interface 910and can be filtered accordingly using the 911.Ox 912packet filter, 913.Xr pf 4 . 914The grammar for the packet filter is described in 915.Xr pf.conf 5 . 916.Pp 917The following components are relevant to filtering IPsec traffic: 918.Bl -ohang -offset indent 919.It external interface 920Interface for IKE traffic and encapsulated IPsec traffic. 921.It proto udp port 500 922IKE traffic on the external interface. 923.It proto udp port 4500 924IKE NAT-Traversal traffic on the external interface. 925.It proto ah | esp 926Encapsulated IPsec traffic 927on the external interface. 928.It enc0 929Default interface for outgoing traffic before it's been encapsulated, 930and incoming traffic after it's been decapsulated. 931State on this interface should be interface bound; 932see 933.Xr enc 4 934for further information. 935.It proto ipencap 936[tunnel mode only] 937IP-in-IP traffic flowing between gateways 938on the enc0 interface. 939.It tagged ipsec-example.org 940Match traffic of IPsec SAs using the 941.Ic tag 942keyword. 943.El 944.Pp 945If the filtering rules specify to block everything by default, 946the following rule 947would ensure that IPsec traffic never hits the packet filtering engine, 948and is therefore passed: 949.Bd -literal -offset indent 950set skip on enc0 951.Ed 952.Pp 953In the following example, all traffic is blocked by default. 954IPsec-related traffic from gateways {192.168.3.1, 192.168.3.2} and 955networks {10.0.1.0/24, 10.0.2.0/24} is permitted. 956.Bd -literal -offset indent 957block on ix0 958block on enc0 959 960pass in on ix0 proto udp from 192.168.3.2 to 192.168.3.1 \e 961 port {500, 4500} 962pass out on ix0 proto udp from 192.168.3.1 to 192.168.3.2 \e 963 port {500, 4500} 964 965pass in on ix0 proto esp from 192.168.3.2 to 192.168.3.1 966pass out on ix0 proto esp from 192.168.3.1 to 192.168.3.2 967 968pass in on enc0 proto ipencap from 192.168.3.2 to 192.168.3.1 \e 969 keep state (if-bound) 970pass out on enc0 proto ipencap from 192.168.3.1 to 192.168.3.2 \e 971 keep state (if-bound) 972pass in on enc0 from 10.0.2.0/24 to 10.0.1.0/24 \e 973 keep state (if-bound) 974pass out on enc0 from 10.0.1.0/24 to 10.0.2.0/24 \e 975 keep state (if-bound) 976.Ed 977.Pp 978.Xr pf 4 979has the ability to filter IPsec-related packets 980based on an arbitrary 981.Em tag 982specified within a ruleset. 983The tag is used as an internal marker 984which can be used to identify the packets later on. 985This could be helpful, 986for example, 987in scenarios where users are connecting in from differing IP addresses, 988or to support queue-based bandwidth control, 989since the enc0 interface does not support it. 990.Pp 991The following 992.Xr pf.conf 5 993fragment uses queues for all IPsec traffic with special 994handling for developers and employees: 995.Bd -literal -offset indent 996queue std on ix0 bandwidth 100M 997queue deflt parent std bandwidth 10M default 998queue developers parent std bandwidth 75M 999queue employees parent std bandwidth 5M 1000queue ipsec parent std bandwidth 10M 1001 1002pass out on ix0 proto esp set queue ipsec 1003 1004pass out on ix0 tagged ipsec-developers.example.com \e 1005 set queue developers 1006pass out on ix0 tagged ipsec-employees.example.com \e 1007 set queue employees 1008.Ed 1009.Pp 1010The following example assigns the tags in the 1011.Nm 1012configuration and also sets an alternative 1013.Xr enc 4 1014device: 1015.Bd -literal -offset indent 1016ikev2 esp from 10.1.1.0/24 to 10.1.2.0/24 peer 192.168.3.2 \e 1017 tag "ipsec-$domain" tap "enc1" 1018.Ed 1019.Sh OUTGOING NETWORK ADDRESS TRANSLATION 1020In some network topologies it is desirable to perform NAT on traffic leaving 1021through the VPN tunnel. 1022In order to achieve that, 1023the 1024.Ar src 1025argument is used to negotiate the desired network ID with the peer 1026and the 1027.Ar srcnat 1028parameter defines the true local subnet, 1029so that a correct SA can be installed on the local side. 1030.Pp 1031For example, 1032if the local subnet is 192.168.1.0/24 and all the traffic 1033for a specific VPN peer should appear as coming from 10.10.10.1, 1034the following configuration is used: 1035.Bd -literal -offset indent 1036ikev2 esp from 10.10.10.1 (192.168.1.0/24) to 192.168.2.0/24 \e 1037 peer 10.10.20.1 1038.Ed 1039.Pp 1040Naturally, 1041a relevant NAT rule is required in 1042.Xr pf.conf 5 . 1043For the example above, 1044this would be: 1045.Bd -literal -offset indent 1046match out on enc0 from 192.168.1.0/24 to 192.168.2.0/24 \e 1047 nat-to 10.10.10.1 1048.Ed 1049.Pp 1050From the peer's point of view, 1051the local end of the VPN tunnel is declared to be 10.10.10.1 1052and all the traffic arrives with that source address. 1053.Sh CRYPTO TRANSFORMS 1054The following authentication types are permitted with the 1055.Ic auth 1056keyword: 1057.Bl -column "Authentication" "Key Length" "Truncated Length" "Default" -offset indent 1058.It Em "Authentication" Ta Em "Key Length" Ta Em "Truncated Length" Ta Em "Default" 1059.It Li hmac-md5 Ta "128 bits" Ta "96 bits" Ta "" 1060.It Li hmac-sha1 Ta "160 bits" Ta "96 bits" Ta "x" 1061.It Li hmac-sha2-256 Ta "256 bits" Ta "128 bits" Ta "x" 1062.It Li hmac-sha2-384 Ta "384 bits" Ta "192 bits" Ta "x" 1063.It Li hmac-sha2-512 Ta "512 bits" Ta "256 bits" Ta "x" 1064.El 1065.Pp 1066The following pseudo-random function types are permitted with the 1067.Ic prf 1068keyword: 1069.Bl -column "hmac-sha2-512" "Key Length" "Default" "[IKE only]" -offset indent 1070.It Em "PRF" Ta Em "Key Length" Ta Em "Default" Ta "" 1071.It Li hmac-md5 Ta "128 bits" Ta "" Ta "[IKE only]" 1072.It Li hmac-sha1 Ta "160 bits" Ta "x" Ta "[IKE only]" 1073.It Li hmac-sha2-256 Ta "256 bits" Ta "x" Ta "[IKE only]" 1074.It Li hmac-sha2-384 Ta "384 bits" Ta "x" Ta "[IKE only]" 1075.It Li hmac-sha2-512 Ta "512 bits" Ta "x" Ta "[IKE only]" 1076.El 1077.Pp 1078The following cipher types are permitted with the 1079.Ic enc 1080keyword: 1081.Bl -column "chacha20-poly1305" "Key Length" "Default" "[ESP only]" -offset indent 1082.It Em "Cipher" Ta Em "Key Length" Ta Em "Default" Ta "" 1083.It Li 3des Ta "168 bits" Ta "x" Ta "" 1084.It Li aes-128 Ta "128 bits" Ta "x" Ta "" 1085.It Li aes-192 Ta "192 bits" Ta "x" Ta "" 1086.It Li aes-256 Ta "256 bits" Ta "x" Ta "" 1087.It Li aes-128-ctr Ta "160 bits" Ta "" Ta "[ESP only]" 1088.It Li aes-192-ctr Ta "224 bits" Ta "" Ta "[ESP only]" 1089.It Li aes-256-ctr Ta "288 bits" Ta "" Ta "[ESP only]" 1090.It Li aes-128-gcm Ta "160 bits" Ta "x" Ta "" 1091.It Li aes-192-gcm Ta "224 bits" Ta "" Ta "[ESP only]" 1092.It Li aes-256-gcm Ta "288 bits" Ta "x" Ta "" 1093.It Li aes-128-gcm-12 Ta "160 bits" Ta "" Ta "[IKE only]" 1094.It Li aes-256-gcm-12 Ta "288 bits" Ta "" Ta "[IKE only]" 1095.It Li blowfish Ta "160 bits" Ta "" Ta "[ESP only]" 1096.It Li cast Ta "128 bits" Ta "" Ta "[ESP only]" 1097.It Li chacha20-poly1305 Ta "288 bits" Ta "" Ta "[ESP only]" 1098.El 1099.Pp 1100The following cipher types provide only authentication, 1101not encryption: 1102.Bl -column "chacha20-poly1305" "Key Length" "Default" "[ESP only]" -offset indent 1103.It Li aes-128-gmac Ta "160 bits" Ta "" Ta "[ESP only]" 1104.It Li aes-192-gmac Ta "224 bits" Ta "" Ta "[ESP only]" 1105.It Li aes-256-gmac Ta "288 bits" Ta "" Ta "[ESP only]" 1106.It Li null Ta "" Ta "" Ta "[ESP only]" 1107.El 1108.Pp 1109The Extended Sequence Numbers option can be enabled or disabled with the 1110.Ic esn 1111or 1112.Ic noesn 1113keywords: 1114.Bl -column "noesn" "Default" "[ESP only]" -offset indent 1115.It Em ESN Ta Em "Default" Ta Em "" 1116.It Li esn Ta "x" Ta "[ESP only]" 1117.It Li noesn Ta "x" Ta "[ESP only]" 1118.El 1119.Pp 1120Transforms followed by 1121.Bq IKE only 1122can only be used with the 1123.Ic ikesa 1124keyword, transforms with 1125.Bq ESP only 1126can only be used with the 1127.Ic childsa 1128keyword. 1129.Pp 1130Using AES-GMAC or NULL with ESP will only provide authentication. 1131This is useful in setups where AH cannot be used, e.g. when NAT is involved. 1132.Pp 1133The following group types are permitted with the 1134.Ic group 1135keyword: 1136.Bl -column "sntrup761x25519" "Group" "1190 B" "Hybrid PQKE" "Default" -offset indent 1137.It Em Name Ta Em Group Ta Em Size Ta Em Type Ta Em Default 1138.It Li modp768 Ta grp1 Ta 768 Ta "MODP" Ta "" Ta "[insecure]" 1139.It Li modp1024 Ta grp2 Ta 1024 Ta "MODP" Ta "x" Ta "[weak]" 1140.It Li modp1536 Ta grp5 Ta 1536 Ta "MODP" Ta "x" Ta "[weak]" 1141.It Li modp2048 Ta grp14 Ta 2048 Ta "MODP" Ta "x" 1142.It Li modp3072 Ta grp15 Ta 3072 Ta "MODP" Ta "x" 1143.It Li modp4096 Ta grp16 Ta 4096 Ta "MODP" Ta "x" 1144.It Li modp6144 Ta grp17 Ta 6144 Ta "MODP" Ta "" 1145.It Li modp8192 Ta grp18 Ta 8192 Ta "MODP" Ta "" 1146.It Li ecp256 Ta grp19 Ta 256 Ta "ECP" Ta "x" 1147.It Li ecp384 Ta grp20 Ta 384 Ta "ECP" Ta "x" 1148.It Li ecp521 Ta grp21 Ta 521 Ta "ECP" Ta "x" 1149.It Li ecp192 Ta grp25 Ta 192 Ta "ECP" Ta "" 1150.It Li ecp224 Ta grp26 Ta 224 Ta "ECP" Ta "" 1151.It Li brainpool224 Ta grp27 Ta 224 Ta "ECP" Ta "" 1152.It Li brainpool256 Ta grp28 Ta 256 Ta "ECP" Ta "" 1153.It Li brainpool384 Ta grp29 Ta 384 Ta "ECP" Ta "" 1154.It Li brainpool512 Ta grp30 Ta 512 Ta "ECP" Ta "" 1155.It Li curve25519 Ta grp31 Ta 256 Ta "Curve25519" Ta "x" 1156.It Li sntrup761x25519 Ta "" Ta 1190 B Ta "Hybrid PQKE" Ta "" 1157.El 1158.Pp 1159The currently supported group types are either 1160MODP (exponentiation groups modulo a prime), 1161ECP (elliptic curve groups modulo a prime), 1162or Curve25519. 1163MODP groups of less than 2048 bits are considered 1164as weak or insecure (see RFC 8247 section 2.4) and only provided for 1165backwards compatibility. 1166.Sh FILES 1167.Bl -tag -width /etc/examples/iked.conf -compact 1168.It Pa /etc/iked.conf 1169.It Pa /etc/examples/iked.conf 1170.El 1171.Sh EXAMPLES 1172The first example is intended for a server with clients connecting to 1173.Xr iked 8 1174as an IPsec gateway, or IKEv2 responder, using mutual public key 1175authentication and additional challenge-based EAP-MSCHAPv2 password 1176authentication: 1177.Bd -literal -offset indent 1178user "test" "password123" 1179 1180ikev2 "win7" esp \e 1181 from dynamic to 172.16.2.0/24 \e 1182 peer 10.0.0.0/8 local 192.168.56.0/24 \e 1183 eap "mschap-v2" \e 1184 config address 172.16.2.1 \e 1185 tag "$name-$id" 1186.Ed 1187.Pp 1188The next example allows peers to authenticate using a pre-shared key 1189.Sq foobar : 1190.Bd -literal -offset indent 1191ikev2 "big test" \e 1192 esp proto tcp \e 1193 from 10.0.0.0/8 port 23 to 20.0.0.0/8 port 40 \e 1194 from 192.168.1.1 to 192.168.2.2 \e 1195 peer any local any \e 1196 ikesa \e 1197 enc aes-128-gcm \e 1198 group ecp256 group curve25519 \e 1199 ikesa \e 1200 enc aes-128 auth hmac-sha2-256 \e 1201 group ecp256 group curve25519 \e 1202 childsa enc aes-128-gcm \e 1203 childsa enc aes-128 auth hmac-sha2-256 \e 1204 srcid host.example.com \e 1205 dstid 192.168.0.254 \e 1206 psk "foobar" 1207.Ed 1208.Pp 1209The following example illustrates the last matching policy 1210evaluation for incoming connections on an IKEv2 gateway. 1211The peer 192.168.1.34 will always match the first policy because of the 1212.Ar quick 1213keyword; 1214connections from the peers 192.168.1.3 and 192.168.1.2 will be matched 1215by one of the last two policies; 1216any other connections from 192.168.1.0/24 will be matched by the 1217.Sq subnet 1218policy; 1219and any other connection will be matched by the 1220.Sq catch all 1221policy. 1222.Bd -literal -offset indent 1223ikev2 quick esp from 10.10.10.0/24 to 10.20.20.0/24 \e 1224 peer 192.168.1.34 1225ikev2 "catch all" esp from 10.0.1.0/24 to 10.0.2.0/24 \e 1226 peer any 1227ikev2 "subnet" esp from 10.0.3.0/24 to 10.0.4.0/24 \e 1228 peer 192.168.1.0/24 1229ikev2 esp from 10.0.5.0/30 to 10.0.5.4/30 peer 192.168.1.2 1230ikev2 esp from 10.0.5.8/30 to 10.0.5.12/30 peer 192.168.1.3 1231.Ed 1232.Pp 1233This example encrypts a 1234.Xr gre 4 1235tunnel from local machine A (2001:db8::aa:1) to peer D (2001:db8::dd:4) based on 1236FQDN-based public key authentication; 1237.Ar transport 1238mode avoids double encapsulation: 1239.Bd -literal -offset indent 1240ikev2 transport \e 1241 proto gre \e 1242 from 2001:db8::aa:1 to 2001:db8::dd:4 \e 1243 peer D.example.com 1244.Ed 1245.Sh SEE ALSO 1246.Xr enc 4 , 1247.Xr ipsec 4 , 1248.Xr ipsec.conf 5 , 1249.Xr pf.conf 5 , 1250.Xr ikectl 8 , 1251.Xr iked 8 1252.Sh HISTORY 1253The 1254.Nm 1255file format first appeared in 1256.Ox 4.8 . 1257.Sh AUTHORS 1258The 1259.Xr iked 8 1260program was written by 1261.An Reyk Floeter Aq Mt reyk@openbsd.org . 1262