denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

man: Document IKEv2 fragmentation in ipsec.conf(5)

Browse Source
This commit is contained in:
Tobias Brunner
2015-02-10 18:38:54 +01:00
parent 482810141c
commit aaf9911aeb
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+5 -4
View File
@@ -446,19 +446,20 @@ This may help to surmount restrictive firewalls. In order to force the peer to
encapsulate packets, NAT detection payloads are faked. encapsulate packets, NAT detection payloads are faked.
.TP .TP
.BR fragmentation " = yes | force | " no .BR fragmentation " = yes | force | " no
whether to use IKE fragmentation (proprietary IKEv1 extension). Acceptable whether to use IKE fragmentation (proprietary IKEv1 extension or IKEv2
values are fragmentation as per RFC 7383). Acceptable values are
.BR yes , .BR yes ,
.B force .B force
and and
.B no .B no
(the default). Fragmented messages sent by a peer are always accepted (the default). Fragmented IKE messages sent by a peer are always accepted
irrespective of the value of this option. If set to irrespective of the value of this option. If set to
.BR yes , .BR yes ,
and the peer supports it, larger IKE messages will be sent in fragments. and the peer supports it, larger IKE messages will be sent in fragments.
If set to If set to
.B force .B force
the initial IKE message will already be fragmented if required. (only supported for IKEv1) the initial IKE message will already be fragmented
if required.
.TP .TP
.BR ike " = <cipher suites>" .BR ike " = <cipher suites>"
comma-separated list of IKE/ISAKMP SA encryption/authentication algorithms comma-separated list of IKE/ISAKMP SA encryption/authentication algorithms