Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 714

Chapter 43. Securing Your Network
To change the authentication key at any time, edit the keys-ipsec1 file on both workstations. Both
authentication keys must be identical for proper connectivity.
The next example shows the specific configuration for the phase 1 connection to the remote host. The
file is called X.X.X.X.conf, where X.X.X.X is the IP address of the remote IPsec host. Note that
this file is automatically generated when the IPsec tunnel is activated and should not be edited directly.
remote X.X.X.X
{
exchange_mode aggressive, main;
my_identifier address;
proposal {
encryption_algorithm 3des;
hash_algorithm sha1;
authentication_method pre_shared_key;
dh_group 2 ;
}
}
The default phase 1 configuration file that is created when an IPsec connection is initialized contains
the following statements used by the Red Hat Enterprise Linux implementation of IPsec:
remote X.X.X.X
Specifies that the subsequent stanzas of this configuration file apply only to the remote node
identified by the X.X.X.X IP address.
exchange_mode aggressive
The default configuration for IPsec on Red Hat Enterprise Linux uses an aggressive authentication
mode, which lowers the connection overhead while allowing configuration of several IPsec
connections with multiple hosts.
my_identifier address
Specifies the identification method to use when authenticating nodes. Red Hat Enterprise Linux
uses IP addresses to identify nodes.
encryption_algorithm 3des
Specifies the encryption cipher used during authentication. By default, Triple Data Encryption
Standard (3DES) is used.
hash_algorithm sha1;
Specifies the hash algorithm used during phase 1 negotiation between nodes. By default, Secure
Hash Algorithm version 1 is used.
authentication_method pre_shared_key
Specifies the authentication method used during node negotiation. By default, Red Hat Enterprise
Linux uses pre-shared keys for authentication.
dh_group 2
Specifies the Diffie-Hellman group number for establishing dynamically-generated session keys.
By default, modp1024 (group 2) is used.
43.7.6.2.1. The Racoon Configuration File
The /etc/racoon/racoon.conf files should be identical on all IPsec nodes except for the
include "/etc/racoon/X.X.X.X.conf" statement. This statement (and the file it references)
688