Chapter 8

Select the CA tab, and repeat the import step, this time for the CA certificate. Close the Certificate Manager by closing the window.

Now you can select your newly imported certificate in the Own Certificate box. Set Remote Certificate to Verify with CAs.

Click OK, and open the Identifiers tab. Choose Own certificate and Remote certificate for the Local and Remote Identifiers. Click OK, and now you are again ready to bring up the tunnel using Start VPN. There is also Log button, which provides a convenient way to access the log.

Manual Racoon Configuration

Since IPSecuritas nicely presents us with the configuration files, we include these here for those who wish to use Racoon manually in their own scripts. This is racoon.conf:

# IPSecuritas V1.0 racoon.conf

path pre_shared_key "/tmp/ipsecuritas_psk.txt"; path certificate "/tmp/ipsecuritas_certs"; padding

{
maximum_length 20;	# maximum padding length.
randomize off;	# enable randomize length.
strict_check off;	# enable strict check.
exclusive_tail off;	# extract last one octet.
}
# Specification of default various timer.
timer
{
# These value can be changed per remote node.
counter 5;	# maximum trying count to send.
interval 20 sec;	# maximum interval to resend.
persend 1;	# the number of packets per a send.

# timer for waiting to complete each phase. phase1 30 sec;

phase2 30 sec;

}

remote 193.110.157.131 { exchange_mode main; doi ipsec_doi;

situation identity_only;

certificate_type x509 "openswan.cert" "openswan.priv"; verify_cert off;

my_identifier asn1dn; peers_identifier asn1dn; verify_identifier off; lifetime time 28800 seconds; initial_contact on;

passive off; proposal_check obey;

197