denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added an option that allows to force IKEv1 fragmentation

Browse Source
This commit is contained in:
Tobias Brunner
2013-01-12 11:54:32 +01:00
parent 97973f8609
commit 365d9a6f67
20 changed files with 76 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+9 -4
View File
@@ -403,15 +403,20 @@ force UDP encapsulation for ESP packets even if no NAT situation is detected.
This may help to surmount restrictive firewalls. In order to force the peer to
encapsulate packets, NAT detection payloads are faked.
.TP
.BR fragmentation " = yes | " no
.BR fragmentation " = yes | force | " no
whether to use IKE fragmentation (proprietary IKEv1 extension). Acceptable
values are
.B yes
.BR yes ,
.B force
and
.B no
(the default). Fragmented messages sent by a peer are always accepted
irrespective of the value of this option. If enabled, and the peer supports it,
larger IKE messages will be sent in fragments.
irrespective of the value of this option. If set to
.BR yes ,
and the peer supports it, larger IKE messages will be sent in fragments.
If set to
.B force
the initial IKE message will already be fragmented if required.
.TP
.BR ike " = <cipher suites>"
comma-separated list of IKE/ISAKMP SA encryption/authentication algorithms