denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

implemented IKEv2 force_encap connection parameter

Browse Source 
enforces UDP encapsulation by faking NAT detection payloads
  to hurdle restrictive firewalls
This commit is contained in:
Martin Willi
2007-10-01 12:19:39 +00:00
parent 92232dab33
commit 9dae1bed00
16 changed files with 101 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/starter/ipsec.conf.5
+5
View File
@@ -365,6 +365,11 @@ for the connection, e.g.
(encryption-integrity-[dh-group]). If dh-group is specified, CHILD_SA setup
and rekeying include a separate diffe hellman exchange (IKEv2 only).
.TP
.B force_encap
Force UDP encapsulation for ESP packets even if no NAT situation is detected.
This may help to hurdle restrictive firewalls. To enforce the peer to
encapsulate packets, NAT detection payloads are faked (IKEv2 only).
.TP
.B ike
IKE/ISAKMP SA encryption/authentication algorithm to be used, e.g.
.B aes128-sha1-modp2048