Re: Using gre(4), gif(4) ontop of ipsec(4) and other ISAKMPd scalability issues.

[Markus Friedl <markus@openbsd.org>]

> Also, as for phase-1 authentication, pre-shared secret keys doesn't seem
> to scale well above and beyond simple point-to-point configurations, but

preshared is bogus IMHO.

i run isakmpd with RSA authentication, but without certificates.

this is similar to what ssh does.

see
     openssl(1)) and named and stored after this easy formula:
     For IPv4 identities   /etc/isakmpd/pubkeys/ipv4/A.B.C.D
     For IPv6 identities   /etc/isakmpd/pubkeys/ipv6/abcd:abcd::ab:bc
     For FQDN identities   /etc/isakmpd/pubkeys/fqdn/foo.bar.org
     For UFQDN identities  /etc/isakmpd/pubkeys/ufqdn/user@foo.bar.org

in isakmpd(8)