Vycházím s předchozí konfigurace. Tedy použiji stejné certifikáty.

                   I  N  T  E  R  N  E  T
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
          |                                 |
          |                                 |
eth1: 212.96.165.122/28          lan: 212.96.165.121/28
     +---------+                      +-----------+
     | pikachu |                      |  yoghurt  |
     +---------+                      +-----------+
eth0: 10.16.66.53/19             virt: 10.225.64.2/19
virt: 10.225.64.1/19
          |
        L A N

Na straně hosta pikachu je následující konfigurace. Soubor /etc/racoon/racoon.conf:

# Konfigurace s pouzitim certifikatu

#log debug;     #notify/debug/debug2
log notify;

path certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

listen {
        isakmp 212.96.165.122;
}

remote anonymous
{
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;

        lifetime time 24 hour;          # min/hour
        initial_contact on;

        my_identifier asn1dn;
        peers_identifier asn1dn;
        certificate_type x509 "pikachu.crt" "pikachu.key";
        
        proposal {
                encryption_algorithm 3des;
                hash_algorithm md5;
                #authentication_method rsasig;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}

sainfo anonymous {
        pfs_group modp1024;
        lifetime time 1 hour;           # min/hour
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

V souboru /etc/racoon/spd.conf je

#!/usr/sbin/setkey -f
# pikachu:/etc/racoon/ipsec.conf

### Flush all
flush;
spdflush;

### Security Policy
spdadd 212.96.165.122 212.96.165.121 any -P out ipsec
        esp/transport//require;
spdadd 212.96.165.121 212.96.165.122 any -P in ipsec
        esp/transport//require;
# TUNNEL MODE
spdadd 10.16.64.0/19 10.225.64.0/19 any -P out ipsec
        esp/tunnel/212.96.165.122-212.96.165.121/require;
spdadd 10.225.64.0/19 10.16.64.0/19 any -P in ipsec
        esp/tunnel/212.96.165.121-212.96.165.122/require;

Na straně hosta yoghurt je konfigurace následující. V souboru /etc/racoon/racoon.conf je

# Konfigurace s pouzitim certifikatu

log debug2;

path  certificate "/etc/racoon/certs";
path pre_shared_key "/etc/racoon/psk.txt";

remote anonymous
{
        exchange_mode aggressive,main;
        doi ipsec_doi;
        situation identity_only;

        lifetime time 2 min;
        initial_contact on;
        proposal_check obey;

        my_identifier asn1dn;
        peers_identifier asn1dn;
        certificate_type x509 "yoghurt.crt" "yoghurt.key";

        proposal {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }
}

sainfo anonymous
{
        pfs_group modp1024;
        lifetime time 5 min;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

V souboru /etc/racoon/spd.conf je:

#!/usr/sbin/setkey -f

flush;
spdflush;

spdadd 212.96.165.121 212.96.165.122 any -P out ipsec
        esp/transport//require;
spdadd 212.96.165.122 212.96.165.121 any -P in ipsec
        esp/transport//require;

spdadd 10.225.64.0/19 10.16.64.0/19 any -P out ipsec
        esp/tunnel/212.96.165.121-212.96.165.122/require;
spdadd 10.16.64.0/19 10.225.64.0/19 any -P out ipsec
        esp/tunnel/212.96.165.122-212.96.165.121/require;

Spojení nefunguje.