;-----------------------------------------------------------------------------
; CONFIGURATION FILE
;-----------------------------------------------------------------------------
; Purpose..:  Define Security Association (SA) bundles for IPSec
; Remarks..:  For security reasons, you must use numeric IP addresses
;             in IPSec SA bundles (not host names).
; Syntax...:  Records begin in first position of a line.
;             Strings and IP addresses must be in quotes.
;             Blank line(s) terminate a record.
;             Lines starting with the '#' or ';' denote a comment.
;             Default values provided by matching file in the TEMPLATE dir.
;             Records must have unique names.
; Help.....:  Product documentation and matching template/.dct file.
; Errors...:  Written to logs/ipsec.log
;_____________________________________________________________________________


;-----------------------------------------------------------------------------
; General Comments:
;-----------------------------------------------------------------------------
;     Passwords prefixed with '-' are encrypted passwords, saved by the
;     IPSec GUI. Un-encrypted passwords (without any leading '-') may be
;     manually entered in clear text.
;
;     Before deploying any of the samples in this file, be sure to change
;     the passwords and the IP numbers to reflect your network configuration. 
;     It is also a good idea to check the relevant documentation sections.
;-----------------------------------------------------------------------------


;-----------------------------------------------------------------------------
; IPSec SA Examples:
;-----------------------------------------------------------------------------
;
; VPN-Wizard-Server and VPN-Wizard-Client:
;     These two Security Associations are used internally by the VPN Wizard.
;     They make use of advanced vendor-specific Road Warrior features,
;     specifically: VPN server internal-net detection and a server-side
;     database of RW's with static IP addresses.
;     It is not recommended that you change the VPN Wizard SAs manually.
;
; Secure-Client and Secure-Server:
;     These two Security Associations demonstrate the simplicity
;     of connecting two networks over IPSec. Authentication is based on the
;     preshared key and static IP addresses of both endpoints.
;
; Secure-RW-Server, Secure-RW-Client and Secure-RW-Client-2:
;     One authenticating IPSec gateway (Secure-RW-Server) accepts remote
;     IPSec clients. Both remote clients have internal nets behind,
;     which must be part of the Secure-RW-Server's remote net.
;     The remote RW clients must authenticate with user ID and password.
;     The preshared key is used for initial authentication.
;
; Manual keying example:
;     Two very simple deployment-ready sample SAs are included to demonstrate
;     the manual keying VPN scenario. One example for host A, and another for
;     host B.
;
;     Pregenerated manual keys should only be used when automated key
;     generation cannot be used - as static keys are less secure. The
;     IKE server is not required for setups that use manual keys and
;     traffic is authenticated only by its IP address.
;
;     Both the ESP-Key and the Remote-ESP-Key are 3DES (24 bytes or 48
;     characters of hexidecimal notation). The keys are followed by an MD5
;     key (16 bytes or 32 characters) - 80 characters in total. The keys can
;     be changed to any contents (you can imagine), as long as it's the
;     same in both ends.
;
;     The Manual keys themselves are not not configurable in the IPSec GUI.
;     
;-----------------------------------------------------------------------------


VPN-Wizard-Server	Description = "VPN Wizard RW Server template, with X-auth.",
		Local-IP = "My_IP",
		Local-Net = "10.1.1.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "0.0.0.0",
		Remote-Net = "0.0.0.0",
		Remote-Mask = "0.0.0.0",
		Reinit = No,
		SA-Status = Disabled,
		Auth-Type = Server-Xauth,
		Preshared-Secret = "-73199b069518",
		Vendor-ID = Server-Extended-RW,
		ISAKMP-Lifetime = 1800,
		IPSec-Lifetime = 1700,
		IP-Compression = Auto,

VPN-Wizard-Client	Description = "VPN Wizard RW Client template.",
		Local-IP = "0.0.0.0",
		Local-Net = "10.2.1.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "100.100.100.100",
		SA-Status = Disabled,
		Auth-Type = Client-Xauth,
		User-Id = "test",
		Password = "-63099b019d0e8d16",
		Preshared-Secret = "-73199b069518",
		Vendor-ID = Extended-RW,
		ISAKMP-Lifetime = 1000,
		IPSec-Lifetime = 900,
		IP-Compression = Yes,


Secure-Server	Description = "Simple VPN Server for remote client 12.13.14.15.",
		Local-IP = "My_IP",
		Local-Net = "10.1.1.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "12.13.14.15",
		Remote-Net = "10.2.2.0",
		Remote-Mask = "255.255.255.0",
		SA-Status = Disabled,
		Preshared-Secret = "-73199b069518"

Secure-Client	Description = "Simple VPN Client connecting to 123.123.123.123",
		Local-IP = "My_IP",
		Local-Net = "10.2.2.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "123.123.123.123",
		Remote-Net = "10.1.1.0",
		Remote-Mask = "255.255.255.0",
		SA-Status = Disabled,
		Preshared-Secret = "-73199b069518"


Secure-RW-Server	Description = "Gateway for Road Warriors (with X-authentication)",
		Local-IP = "My_IP",
		Local-Net = "10.1.1.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "0.0.0.0",
		Remote-Net = "10.2.0.0",
		Remote-Mask = "255.255.0.0",
		Reinit = No,
		SA-Status = Disabled,
		Auth-Type = Server-Xauth,
		Preshared-Secret = "-73199b069518"

Secure-RW-Client-1	Description = "Road Warrior client. Internal net: 10.2.1.*.",
		Local-IP = "0.0.0.0",
		Local-Net = "10.2.1.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "100.100.100.100",
		Remote-Net = "10.1.1.0",
		Remote-Mask = "255.255.255.0",
		SA-Status = Disabled,
		Auth-Type = Client-Xauth,
		User-Id = "test",
		Password = "-63099b019d0e8d16",
		Preshared-Secret = "-73199b069518"

Secure-RW-Client-2	Description = "Road Warrior client. Internal net: 10.2.2.*.",
		Local-IP = "0.0.0.0",
		Local-Net = "10.2.2.0",
		Local-Mask = "255.255.255.0",
		Remote-IP = "100.100.100.100",
		Remote-Net = "10.1.1.0",
		Remote-Mask = "255.255.0.0",
		SA-Status = Disabled,
		Auth-Type = Client-Xauth,
		User-Id = "test",
		Password = "-63099b019d0e8d16",
		Preshared-Secret = "-73199b069518"


Manual-Key-Host-A
		Description = "Manual Keys (Host A).",
		SA-Status = Disabled,
		Local-IP = "My_IP",
		Remote-IP = "217.126.17.44",
		Remote-ESP-Key = "00FFEEDDCCBBAA00112233445566778899FFEEDDCCBBAAFFEEDDCCAA99887766554433221100FFAA",
		ESP-Key = "00112233445566778899AABBCCDDEEFF001122334455667700112233445566778899AABBCCDDEEFF",
		ESP-Transmit-SPI = 512,
		ESP-Receive-SPI = 513,

Manual-Key-Host-B
		Description = "Manual Keys (Host B).",
		SA-Status = Disabled,
		Local-IP = "My_IP",
		Remote-IP = "211.56.33.12",
		ESP-Key = "00FFEEDDCCBBAA00112233445566778899FFEEDDCCBBAAFFEEDDCCAA99887766554433221100FFAA",
		Remote-ESP-Key = "00112233445566778899AABBCCDDEEFF001122334455667700112233445566778899AABBCCDDEEFF",
		ESP-Receive-SPI = 512,
		ESP-Transmit-SPI = 513,
