path pre_shared_key "/etc/racoon/psk.txt";
path certificate "/etc/racoon/certs";
log debug;

listen {
    isakmp 222.48.47.234 [500];

    }
#
# Connection aclass
#
remote 111.48.47.233 {
        nat_traversal on;

        proposal {
                encryption_algorithm 3des;
                hash_algorithm md5;
                authentication_method pre_shared_key;
                dh_group modp1024;
        }

        passive off;
       my_identifier address 222.48.47.234;
       verify_identifier off;
        lifetime time 30 min;
        peers_identifier address 111.48.47.233;
        exchange_mode main;
        generate_policy on;
}

sainfo address 172.16.0.0/24[any] any address 192.168.0.0/24[any] any {
        pfs_group modp1024;
        encryption_algorithm 3des;
        authentication_algorithm hmac_md5;
        compression_algorithm deflate;
}

path include "/etc/racoon";

# search this file for pre_shared_key with various ID key.
path pre_shared_key "/etc/racoon/psk.txt";

# racoon will look for certificate file in the directory,
# if the certificate/certificate request payload is received.
#path certificate "/etc/cert";

# "padding" defines some parameter of padding.  You should not touch these.
padding
{
        maximum_length 20;      # maximum padding length.
        randomize off;          # enable randomize length.
        strict_check off;       # enable strict check.
        exclusive_tail off;     # extract last one octet.
}

{
       isakmp server_ip [500];
       isakmp_natt 1server_ip [4500];
}
remote DFL_IP
{
       exchange_mode main;
       doi ipsec_doi;
       situation identity_only;
       my_identifier address server_ip;
       peers_identifier address dfl_ip;
       lifetime time 28800 sec;
       initial_contact on;
       nat_traversal off;
       proposal_check obey;
proposal {
       encryption_algorithm 3des;
       hash_algorithm md5;
       authentication_method pre_shared_key;
       dh_group 2;
       lifetime time 28800 sec;
       }
}

sainfo subnet 192.168.40.0/24 any subnet 192.168.0.0/24 any
{
       pfs_group 2;
       lifetime time 3600 sec;
       encryption_algorithm 3des;
       authentication_algorithm hmac_md5;
       compression_algorithm deflate;
}

spdadd 192.168.0.0/24 192.168.40.0/24 any -P out ipsec esp/tunnel/91.205.195.26-91.205.192.26/require;
spdadd 192.168.40.0/24 192.168.0.0/24 any -P in ipsec esp/tunnel/91.205.192.26-91.205.195.26/require;