<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none"><!--P{margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>I am trying to set up a site-to-site VPN using StrongSwan. The requirements for the VPN are:</p>
<p><br>
</p>
<p>− Encapsulation Security Payload (ESP)<br>
− Encryption: AES-256<br>
− Authentication: SHA-1<br>
− IPSec / IKE Authentication: Pre-shared secret and digital certificate<br>
− IKE: Version 1<br>
− IKE phase 1: Diffie-Hellman group 5<br>
− Perfect Forward Secrecy (PFS): Diffie-Hellman group 1<br>
− Pre-shared secret key</p>
<p><br>
</p>
<p>I have the following as a start in my ipsec.conf file<br>
</p>
<p><br>
</p>
<p>conn %default<br>
ikelifetime=60m<br>
keylife=20m<br>
rekeymargin=3m<br>
keyingtries=1<br>
keyexchange=ikev1<br>
ike=aes256-sha1-modp1536<br>
esp=aes256-sha1-modp1536<br>
authby=secret</p>
<p><br>
</p>
<p><br>
</p>
<p>However, I don't know how to specify the Perfect Forward Secrecy (PFS) as DH group 1. </p>
<p><br>
</p>
<p>I'm also uncertain if the other entries are correct for the requirements above. (Do I need to specify the digital certificate?) (Do I need both an ike and esp line?)<br>
</p>
<p><br>
</p>
<p>Any suggestions, or help would be greatly appreciated. </p>
<p><br>
</p>
<p>Thanks,</p>
<p> Ben Newton<br>
</p>
</body>
</html>