>>>>Статей на опеннете дофига...Конфиг банален - берем параметры туннеля, вбиваем в racoon.conf --> в remote пишешь параметры для первой фазы, в sainfo - для второй фазы, собственно...
>>>
>>>Спасибо, но меня конфиг второго ракуна интерресует...
>>
>>
>>Идентичный с точностью до наоборот
>в смысле до наоборот?
у меня сделано так:
1 racoon.conf на 111.222.333.444
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 111.222.333.444 [500];
}
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 30 sec;
phase2 15 sec;
}
remote 444.333.222.111 [500]
{
#exchange_mode main,aggressive;
exchange_mode aggressive,main;
doi ipsec_doi;
situation identity_only;
nonce_size 16;
lifetime time 60 min; # sec,min,hour
initial_contact on;
support_proxy on;
proposal_check obey;# obey, strict or claim
proposal {
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
}
sainfo anonymous
{
pfs_group 5;
lifetime time 24 hour;
encryption_algorithm blowfish;
authentication_algorithm hmac_sha1;
compression_algorithm deflate;
}
2 racoon.conf на 444.333.222.111
path include "/usr/local/etc/racoon";
path pre_shared_key "/usr/local/etc/racoon/psk.txt";
padding
{
maximum_length 20; # maximum padding length.
randomize off; # enable randomize length.
strict_check off; # enable strict check.
exclusive_tail off; # extract last one octet.
}
listen
{
isakmp 444.333.222.111 [500];
}
timer
{
# These value can be changed per remote node.
counter 5; # maximum trying count to send.
interval 20 sec; # maximum interval to resend.
persend 1; # the number of packets per send.
# maximum time to wait for completing each phase.
phase1 30 sec;
phase2 15 sec;
}
remote 111.222.333.444 [500]
{
#exchange_mode main,aggressive;
exchange_mode aggressive,main;
doi ipsec_doi;
situation identity_only;
nonce_size 16;
lifetime time 60 min; # sec,min,hour
initial_contact on;
support_proxy on;
proposal_check obey;# obey, strict or claim
proposal {
encryption_algorithm blowfish;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 5;
}
}
sainfo anonymous
{
pfs_group 5;
lifetime time 24 hour;
encryption_algorithm blowfish ;
authentication_algorithm hmac_sha1;
compression_algorithm deflate ;
}
Вариант для распечатки
OpenNET: Виртуальная конференция (Public)
(??) on 21-Окт-06, 21:06 
