IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
The transport mode is only permitted for host-to-host communication,
passthrough only for manual key management.
auto = start
If the parameters plutoload and plutostart are set to the special value %search,
then the parameter auto determines whether the present connection is
automatically loaded into the pluto database and activated. In our example the
connection is to be directly activated, so the parameter auto is therefore set to
start.
auth = esp
The parameter auth determines which of the two IPSEC functions,
Encapsulating Security Payload (ESP) or Authentication Header (AH) is used
during authentication. In the present case both encryption and authentication
with ESP are possible. This is the standard setting.
authby = rsasig
It is recommended that authentication is performed using digital signatures
with the RSA algorithm (rsasig setting). This provides a higher level of
security than the "shared secrets" procedure (secret setting) as well as
simplifying administration.
pfs = yes
pfs stands for Perfect Forward Secrecy and means that messages which have
been exchanged in the past are not compromised even if the private keys of
the two gateways become known. (However, the security of future
connections can no longer be assured.) The recommended setting for this
parameter is the default value yes.
keyingtries = 0
Parameter keyingtries specifies the maximum permitted number of attempts at
establishing or updating the corresponding connection. It is recommended that
the special value 0 is entered, i.e. so that there is no limit on the number of
attempts. The preconfigured value 3 for the parameter keyingtries is
inadequate for most applications.
left =
right =
The IP addresses of the two gateways are set through parameters left and right.
It is recommended that the IP addresses are entered numerically rather than
using the special value %defaultroute. By performing a comparison with the
IP addresses which have been assigned to the corresponding network
interfaces of the IT system, FreeS/WAN can detect which of the two roles (left
or right) this IT system is assuming.
leftnexthop =
rightnexthop =
For parameters leftnexthop and rightnexthop, in each case the IP address of the
component which forwards the packets over the insecure network should be
entered. In the present example this component is part of the firewall system.
However, depending on the segmentation and layout of the active network
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000