#
# /etc/ipsec.conf
#
conn %default
         # Authentication Method : Pre-Shared Key
         leftauth=psk
         rightauth=psk
         # Encryption Algorithm : aes-128-cbc
         # Authentication Algorithm : sha1
         # Perfect Forward Secrecy : Diffie-Hellman Group 2
         ike=aes128-sha1-modp1024!
         # Lifetime : 28800 seconds
         ikelifetime=28800s
         # Phase 1 Negotiation Mode : main
         aggressive=no
         # Protocol : esp
         # Encryption Algorithm : aes-128-cbc
         # Authentication Algorithm : hmac-sha1-96
         # Perfect Forward Secrecy : Diffie-Hellman Group 2
         esp=aes128-sha1-modp1024!
         # Lifetime : 3600 seconds
         lifetime=3600s
         # Mode : tunnel
         type=tunnel
         # DPD Interval : 10
         dpddelay=10s
         # DPD Retries : 3
         dpdtimeout=30s
         # Tuning Parameters for AWS Virtual Private Gateway:
         keyexchange=ikev1
         rekey=yes
         reauth=no
         dpdaction=restart
         closeaction=restart
         leftsubnet=0.0.0.0/0,::/0
         rightsubnet=0.0.0.0/0,::/0
         leftupdown=/etc/ipsec-vti.sh
         installpolicy=yes
         compress=no
         mobike=no
conn AWS-VPC-GW1
         # Customer Gateway: :
         left=ROUTER1_PRIVATE_IP
         leftid=CONN1_TUNNEL1_ONPREM_OUTSIDE_IP
         # Virtual Private Gateway :
         right=CONN1_TUNNEL1_AWS_OUTSIDE_IP
         rightid=CONN1_TUNNEL1_AWS_OUTSIDE_IP
         auto=start
         mark=100
         #reqid=1
conn AWS-VPC-GW2
         # Customer Gateway: :
         left=ROUTER1_PRIVATE_IP
         leftid=CONN1_TUNNEL2_ONPREM_OUTSIDE_IP
         # Virtual Private Gateway :
         right=CONN1_TUNNEL2_AWS_OUTSIDE_IP
         rightid=CONN1_TUNNEL2_AWS_OUTSIDE_IP
         auto=start
         mark=200