doc/manpage.d/ipsec_auto.8.html

   1 Content-type: text/html
   2
   3 <HTML><HEAD><TITLE>Manpage of IPSEC_AUTO</TITLE>
   4 </HEAD><BODY>
   5 <H1>IPSEC_AUTO</H1>
   6 Section: Maintenance Commands (8)<BR>Updated: 31 Jan 2002<BR><A HREF="#index">Index</A>
   7 <A HREF="http://localhost/cgi-bin/man/man2html">Return to Main Contents</A><HR>
   8
   9
  10 <A NAME="lbAB">&nbsp;</A>
  11 <H2>NAME</H2>
  12
  13 ipsec auto - control automatically-keyed IPsec connections
  14 <A NAME="lbAC">&nbsp;</A>
  15 <H2>SYNOPSIS</H2>
  16
  17 <B>ipsec</B>
  18
  19 <B>auto</B>
  20
  21 [
  22 <B>--show</B>
  23
  24 ] [
  25 <B>--showonly</B>
  26
  27 ] [
  28 <B>--asynchronous</B>
  29
  30 ]
  31 <BR>
  32
  33 &nbsp;&nbsp;&nbsp;[
  34 <B>--config</B>
  35
  36 configfile
  37 ] [
  38 <B>--verbose</B>
  39
  40 ]
  41 <BR>
  42
  43 &nbsp;&nbsp;&nbsp;operation
  44 connection
  45 <P>
  46 <B>ipsec</B>
  47
  48 <B>auto</B>
  49
  50 [
  51 <B>--show</B>
  52
  53 ] [
  54 <B>--showonly</B>
  55
  56 ] operation
  57 <A NAME="lbAD">&nbsp;</A>
  58 <H2>DESCRIPTION</H2>
  59
  60 <I>Auto</I>
  61
  62 manipulates automatically-keyed FreeS/WAN IPsec connections,
  63 setting them up and shutting them down
  64 based on the information in the IPsec configuration file.
  65 In the normal usage,
  66 <I>connection</I>
  67
  68 is the name of a connection specification in the configuration file;
  69 <I>operation</I>
  70
  71 is
  72 <B>--add</B>,
  73
  74 <B>--delete</B>,
  75
  76 <B>--replace</B>,
  77
  78 <B>--up</B>,
  79
  80 <B>--down</B>,
  81
  82 <B>--route</B>,
  83
  84 or
  85 <B>--unroute</B>.
  86
  87 The
  88 <B>--ready</B>,
  89
  90 <B>--rereadsecrets</B>,
  91
  92 <B>--rereadgroups</B>,
  93
  94 and
  95 <B>--status</B>
  96
  97 <I>operations</I>
  98
  99 do not take a connection name.
 100 <I>Auto</I>
 101
 102 generates suitable
 103 commands and feeds them to a shell for execution.
 104 <P>
 105
 106 The
 107 <B>--add</B>
 108
 109 operation adds a connection specification to the internal database
 110 within
 111 <I>pluto</I>;
 112
 113 it will fail if
 114 <I>pluto</I>
 115
 116 already has a specification by that name.
 117 The
 118 <B>--delete</B>
 119
 120 operation deletes a connection specification from
 121 <I>pluto</I>'s
 122
 123 internal database (also tearing down any connections based on it);
 124 it will fail if the specification does not exist.
 125 The
 126 <B>--replace</B>
 127
 128 operation is equivalent to
 129 <B>--delete</B>
 130
 131 (if there is already a specification by the given name)
 132 followed by
 133 <B>--add</B>,
 134
 135 and is a convenience for updating
 136 <I>pluto</I>'s
 137
 138 internal specification to match an external one.
 139 (Note that a
 140 <B>--rereadsecrets</B>
 141
 142 may also be needed.)
 143 The
 144 <B>--rereadgroups</B>
 145
 146 operation causes any changes to the policy group files to take effect
 147 (this is currently a synonym for
 148 <B>--ready</B>,
 149
 150 but that may change).
 151 None of the other operations alters the internal database.
 152 <P>
 153
 154 The
 155 <B>--up</B>
 156
 157 operation asks
 158 <I>pluto</I>
 159
 160 to establish a connection based on an entry in its internal database.
 161 The
 162 <B>--down</B>
 163
 164 operation tells
 165 <I>pluto</I>
 166
 167 to tear down such a connection.
 168 <P>
 169
 170 Normally,
 171 <I>pluto</I>
 172
 173 establishes a route to the destination specified for a connection as
 174 part of the
 175 <B>--up</B>
 176
 177 operation.
 178 However, the route and only the route can be established with the
 179 <B>--route</B>
 180
 181 operation.
 182 Until and unless an actual connection is established,
 183 this discards any packets sent there,
 184 which may be preferable to having them sent elsewhere based on a more
 185 general route (e.g., a default route).
 186 <P>
 187
 188 Normally,
 189 <I>pluto</I>'s
 190
 191 route to a destination remains in place when a
 192 <B>--down</B>
 193
 194 operation is used to take the connection down
 195 (or if connection setup, or later automatic rekeying, fails).
 196 This permits establishing a new connection (perhaps using a
 197 different specification; the route is altered as necessary)
 198 without having a ``window'' in which packets might go elsewhere
 199 based on a more general route.
 200 Such a route can be removed using the
 201 <B>--unroute</B>
 202
 203 operation
 204 (and is implicitly removed by
 205 <B>--delete</B>).
 206
 207 <P>
 208
 209 The
 210 <B>--ready</B>
 211
 212 operation tells
 213 <I>pluto</I>
 214
 215 to listen for connection-setup requests from other hosts.
 216 Doing an
 217 <B>--up</B>
 218
 219 operation before doing
 220 <B>--ready</B>
 221
 222 on both ends is futile and will not work,
 223 although this is now automated as part of IPsec startup and
 224 should not normally be an issue.
 225 <P>
 226
 227 The
 228 <B>--status</B>
 229
 230 operation asks
 231 <I>pluto</I>
 232
 233 for current connection status.
 234 The output format is ad-hoc and likely to change.
 235 <P>
 236
 237 The
 238 <B>--rereadsecrets</B>
 239
 240 operation tells
 241 <I>pluto</I>
 242
 243 to re-read the
 244 <I>/etc/ipsec.secrets</I>
 245
 246 secret-keys file,
 247 which it normally reads only at startup time.
 248 (This is currently a synonym for
 249 <B>--ready</B>,
 250
 251 but that may change.)
 252 <P>
 253
 254 The
 255 <B>--show</B>
 256
 257 option turns on the
 258 <B>-x</B>
 259
 260 option of the shell used to execute the commands,
 261 so each command is shown as it is executed.
 262 <P>
 263
 264 The
 265 <B>--showonly</B>
 266
 267 option causes
 268 <I>auto</I>
 269
 270 to show the commands it would run, on standard output,
 271 and not run them.
 272 <P>
 273
 274 The
 275 <B>--asynchronous</B>
 276
 277 option, applicable only to the
 278 <B>up</B>
 279
 280 operation,
 281 tells
 282 <I>pluto</I>
 283
 284 to attempt to establish the connection,
 285 but does not delay to report results.
 286 This is especially useful to start multiple connections in parallel
 287 when network links are slow.
 288 <P>
 289
 290 The
 291 <B>--verbose</B>
 292
 293 option instructs
 294 <I>auto</I>
 295
 296 to pass through all output from
 297 <I><A HREF="ipsec_whack.8.html">ipsec_whack</A></I>(8),
 298
 299 including log output that is normally filtered out as uninteresting.
 300 <P>
 301
 302 The
 303 <B>--config</B>
 304
 305 option specifies a non-standard location for the IPsec
 306 configuration file (default
 307 <I>/etc/ipsec.conf</I>).
 308
 309 <P>
 310
 311 See
 312 <I><A HREF="ipsec.conf.5.html">ipsec.conf</A></I>(5)
 313
 314 for details of the configuration file.
 315 Apart from the basic parameters which specify the endpoints and routing
 316 of a connection (<B>left</B>
 317 and
 318 <B>right</B>,
 319
 320 plus possibly
 321 <B>leftsubnet</B>,
 322
 323 <B>leftnexthop</B>,
 324
 325 <B>leftfirewall</B>,
 326
 327 their
 328 <B>right</B>
 329
 330 equivalents,
 331 and perhaps
 332 <B>type</B>),
 333
 334 an
 335 <I>auto</I>
 336
 337 connection almost certainly needs a
 338 <B>keyingtries</B>
 339
 340 parameter (since the
 341 <B>keyingtries</B>
 342
 343 default is poorly chosen).
 344 <A NAME="lbAE">&nbsp;</A>
 345 <H2>FILES</H2>
 346
 347
 348
 349 /etc/ipsec.conf<TT>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</TT>default IPSEC configuration file<BR>
 350 <BR>
 351
 352 /var/run/ipsec.info<TT>&nbsp;&nbsp;&nbsp;</TT><B>%defaultroute</B> information<BR>
 353 <A NAME="lbAF">&nbsp;</A>
 354 <H2>SEE ALSO</H2>
 355
 356 <A HREF="ipsec.conf.5.html">ipsec.conf</A>(5), <A HREF="ipsec.8.html">ipsec</A>(8), <A HREF="ipsec_pluto.8.html">ipsec_pluto</A>(8), <A HREF="ipsec_whack.8.html">ipsec_whack</A>(8), <A HREF="ipsec_manual.8.html">ipsec_manual</A>(8)
 357 <A NAME="lbAG">&nbsp;</A>
 358 <H2>HISTORY</H2>
 359
 360 Written for the FreeS/WAN project
 361 &lt;<A HREF="http://www.freeswan.org">http://www.freeswan.org</A>&gt;
 362 by Henry Spencer.
 363 <A NAME="lbAH">&nbsp;</A>
 364 <H2>BUGS</H2>
 365
 366 Although an
 367 <B>--up</B>
 368
 369 operation does connection setup on both ends,
 370 <B>--down</B>
 371
 372 tears only one end of the connection down
 373 (although the orphaned end will eventually time out).
 374 <P>
 375
 376 There is no support for
 377 <B>passthrough</B>
 378
 379 connections.
 380 <P>
 381
 382 A connection description which uses
 383 <B>%defaultroute</B>
 384
 385 for one of its
 386 <B>nexthop</B>
 387
 388 parameters but not the other may be falsely
 389 rejected as erroneous in some circumstances.
 390 <P>
 391
 392 The exit status of
 393 <B>--showonly</B>
 394
 395 does not always reflect errors discovered during processing of the request.
 396 (This is fine for human inspection, but not so good for use in scripts.)
 397 <P>
 398
 399 <HR>
 400 <A NAME="index">&nbsp;</A><H2>Index</H2>
 401 <DL>
 402 <DT><A HREF="#lbAB">NAME</A><DD>
 403 <DT><A HREF="#lbAC">SYNOPSIS</A><DD>
 404 <DT><A HREF="#lbAD">DESCRIPTION</A><DD>
 405 <DT><A HREF="#lbAE">FILES</A><DD>
 406 <DT><A HREF="#lbAF">SEE ALSO</A><DD>
 407 <DT><A HREF="#lbAG">HISTORY</A><DD>
 408 <DT><A HREF="#lbAH">BUGS</A><DD>
 409 </DL>
 410 <HR>
 411 This document was created by
 412 <A HREF="http://localhost/cgi-bin/man/man2html">man2html</A>,
 413 using the manual pages.<BR>
 414 Time: 21:40:17 GMT, November 11, 2003
 415 </BODY>
 416 </HTML>