[initiator-id] section not documented in isakmpd.conf man page

The man page for isakmpd.conf is missing information on the optional
[initiator-id] section. This is useful in road warrior configurations when
using preshared keys. Instead of getting the preshared key from the Authentication= line in the [ISAKMP-peer] section, isakmpd can get it from a section named after the initiator id. This [initiator-id] section can be remote IPV4 address, IPV6 address, FQDN or UFQDN. Doing this allows you to have different shared secrets for different users.

The man page should also mention this will only work for aggressive mode (not main mode) due to the design of the protocol.

Also note the Authentication= line in the default [ISAKMP-peer] section will take precedence if it is present.

Someone on OpenBSD-misc kindly provided an example isakmpd.conf to illustrate this using UFQDN:

[General]

Listen-on= 192.168.1.1

[Phase 1]

Default=                ISAKMP-clients

[Phase 2]

Passive-Connections= IPsec-clients

[ISAKMP-clients]

Phase=                  1
Transport=              udp
Configuration=          PGP-aggressive-mode


[user1@mydomain.com]


Phase=                  1
Configuration=          PGP-aggressive-mode
Authentication=         mypassword


[user2@mydomain.com]


Phase=                  1
Configuration=          PGP-aggressive-mode
Authentication=         differentpassword


[IPsec-clients]


Phase=                  2
Local-ID=               default-route


[default-route]


ID-type=        IPV4_ADDR_SUBNET
Network=        192.168.154.0
Netmask=        255.255.255.0

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related openbsd.org Links advocacy announce bugs ipv6 misc ports ports-changes security-announce smp source-changes tech Request more information about Pantek