Secrets

• On each gateway, generate an RSA key pair (private and public) using

  # ipsec rsasigkey keybits >>/etc/ipsec.secrets

• Put the private key in /etc/ipsec.secrets, with a wrapper. The result looks like this:

  @gateway.site1.example.org : RSA {
        0x1234af57643.....
        }
  

• Tell everyone your public key. It will be the comment in the output of rsasigkey starting "#pubkey=0x".
• Put the public keys for systems you will communicate with in /etc/ipsec.conf. Add the public key for left as "leftrsasigkey=" followed by the (long!) number from the #pubkey comment. Ditto for "rightrsasigkey=".
• Put the identifiers you will use in the "leftid=" and "rightid=" lines of your /etc/ipsec.conf conn entries. These are the names the systems use to identify themselves during connection negotiation.