diff options
Diffstat (limited to 'conf/options/charon.opt')
| -rw-r--r-- | conf/options/charon.opt | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/conf/options/charon.opt b/conf/options/charon.opt index 6e0b37c57..4c4311e81 100644 --- a/conf/options/charon.opt +++ b/conf/options/charon.opt @@ -260,6 +260,16 @@ charon.port_nat_t = 4500 allocated. Has to be different from **charon.port**, otherwise a random port will be allocated. +charon.prefer_best_path = no + Wether to prefer updating SAs to the path with the best route. + + By default, charon keeps SAs on the routing path with addresses it + previously used if that path is still usable. By setting this option to + yes, it tries more aggressively to update SAs with MOBIKE on routing + priority changes using the cheapest path. This adds more noise, but allows + to dynamically adapt SAs to routing priority changes. This option has no + effect if MOBIKE is not supported or disabled. + charon.prefer_configured_proposals = yes Prefer locally configured proposals for IKE/IPsec over supplied ones as responder (disabling this can avoid keying retries due to INVALID_KE_PAYLOAD @@ -340,6 +350,16 @@ charon.signature_authentication_constraints = yes certificate chain, are also used as constraints against the signature scheme used by peers during IKEv2. +charon.spi_min = 0xc0000000 + The lower limit for SPIs requested from the kernel for IPsec SAs. + + The lower limit for SPIs requested from the kernel for IPsec SAs. Should not + be set lower than 0x00000100 (256), as SPIs between 1 and 255 are reserved + by IANA. + +charon.spi_max = 0xcfffffff + The upper limit for SPIs requested from the kernel for IPsec SAs. + charon.start-scripts {} Section containing a list of scripts (name = path) that are executed when the daemon is started. |