Administrator Guide

Table Of Contents
Figure 12. Tunnel Mode Between Linux Hosts Using Certicate-Based Authentication
iSCSI Initiator Conguration (IPv4)
This example uses the following conguration:
Mint 17 (also known as Qiana)
Linux Kernel 3.13.0-36-generic, x86_64
strongSwan 5.1.2
The following conguration les are relevant:
/etc/strongswan.conf is the conguration le that governs the operation of the strongSwan components (for example,
debugging level, log le locations, and so on). You will not need to modify this le.
/etc/ipsec.conf is the conguration le for IPsec that contains parametric information about the local host and the "peer" hosts
that are congured to use IPsec.
/etc/ipsec.secrets contains shared secrets (pre-shared keys).
/etc/ipsec.d/cacerts/* contains Certicate Authority certicates.
/etc/ipsec.d/certs/* contains intermediate and end-node certicates.
NOTE: Other directories within /etc/ipsec.d can hold certicate revocation lists and other kinds of special certicates,
but they are not discussed here.
Initially, ipsec.conf contains exactly the following text:
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration
config setup
# strictcrlpolicy=yes
# uniqueids = no
# Add connections here.
# Sample VPN connections
# conn sample-self-signed
# leftsubnet=10.1.0.0/16
About Group-Level Security
91