forum.lissyara.su

Код: Выделить всё

ERROR: /usr/local/etc/racoon/racoon.conf:69: ""/cert/client.key" failed to load certificate "/cert/client.crt"

Код: Выделить всё

certificate_type x509 "/cert/client.crt" "/cert/client.key";

Код: Выделить всё

-rw-r--r--  1 ioj  wheel  969 Jul  5 12:21 client.crt
-rw-r--r--  1 ioj  wheel  712 Jul  5 12:20 client.csr
-rw-r--r--  1 ioj  wheel  887 Jul  5 12:19 client.key

Код: Выделить всё

${FwCMD} add allow ip from any to any via gif0
${FwCMD} add allow esp from me to 10.16.5.83 keep-state
${FwCMD} add allow ipencap from any to any
${FwCMD} add allow udp from me to 10.16.5.83 500,1701,4500 keep-state

Код: Выделить всё

$cmd 00005 allow ip from any to any via gif0
$cmd 00010 allow udp from $wanip1 to $wanip2 isakmp
$cmd 00020 allow udp from $wanip2 to $wanip1 isakmp
$cmd 00030 allow ipencap from $wanip1 to $wanip2
$cmd 00040 allow ipencap from $wanip2 to $wanip1
$cmd 00080 allow esp from $wanip1 to $wanip2
$cmd 00090 allow esp from $wanip2 to $wanip1

Код: Выделить всё

path include "usr/local/etc/racoon";


path certificate "usr/local/etc/racoon/cert";

log debug;

padding
{
        maximum_length 20;
        randomize off;
        strict_check off;
        exclusive_tail off;
}

listen
{
        isakmp wlan1 [500];
        isakmp_natt wlan1 [4500];
}

timer
{
        counter 5;
        interval 20 sec;
        natt_keepalive 15 sec;
        persend 1;

        phase1 30 sec;
        phase2 15 sec;
}

remote wlan2 [500]
{
        exchange_mode main,aggressive;
        doi ipsec_doi;
        lifetime time 24 hour;
        passive on;
        generate_policy on;
        proposal_check obey;
        nat_traversal on;
        ike_frag on;
        my_identifier asn1dn;
        peers_identifier asn1dn;
        verify_identifier on;
        send_cr on;
        verify_cert on;
        send_cert on;
        certificate_type x509 "/usr/local/etc/racoon/cert/server.crt" "/usr/local/etc/racoon/cert/server.key";
        ca_type x509 "/usr/local/etc/racoon/cert/ca/ca.crt";
        nonce_size 16;
        initial_contact on;

        proposal {
                encryption_algorithm 3des;
                hash_algorithm sha1;
                authentication_method rsasig;
                dh_group 2;
        }
}

sainfo anonymous
{
        pfs_group 2;
        lifetime time 1 hour;
        encryption_algorithm 3des;
        authentication_algorithm hmac_sha1;
        compression_algorithm deflate;
}

Код: Выделить всё

options         IPSEC_FILTERGIF 
pseudo-device   gif