#######################################################################
# This is a strongSwan /etc/swanctl/conf.d/ file for
# interoperability testing with IPsec on Microsoft Windows.  
#
# Read about strongSwan at https://www.strongswan.org.
#
# This file only uses IKEv1 with a pre-shared key of "P@ssword".  
# The test machines must both be on the 10.0.0.0/8 network.  
# The quick mode traffic selector is only for ICMP and SMB.  
# It works with the default main and quick mode settings on Windows;
# however, each IPsec rule must be set to use the machine-wide
# default authentication method, and that default method must
# be pre-shared key auth (in the properties of the firewall snap-in,
# not in the properties of individual IPsec connection security rules).
#
# These are definitely not recommended security settings, or even 
# required settings in Windows, they are simply settings that will 
# work in a lab as quickly as possible to demonstrate successful 
# interoperability between Linux and Windows. 
#
# With IKEv1, each remote_ts or local_ts may have only a single selector.
# If multiple selectors are needed, multiple children{} must be added,
# as shown below.  Also, every remote_ts and local_ts line must include
# a [protocol] of some type or else Windows will reject the connection.
#######################################################################


connections {
  conn1 {
        remote_addrs = 10.0.0.0/8
        version = 1
        proposals = aes128-sha1-modp1024

        local {
            auth = psk
        }

        remote {
            auth = psk
        }

        children {
            icmponly {
                remote_ts = 10.0.0.0/8[icmp]
                local_ts  = 10.0.0.0/8[icmp]
                mode = transport
                esp_proposals = aes128-sha1
                start_action = trap
            }
            smb445 {
                remote_ts = 10.0.0.0/8[tcp/445]
                local_ts  = 10.0.0.0/8[tcp]
                mode = transport
                esp_proposals = aes128-sha1
                start_action = trap
            }
            smb139 {
                remote_ts = 10.0.0.0/8[tcp/139]
                local_ts  = 10.0.0.0/8[tcp]
                mode = transport
                esp_proposals = aes128-sha1
                start_action = trap
            }
        }
  }
}


secrets {
    ike {
        secret = "P@ssword"
    }
}