Using Pre-Shared Keys (PSK)

Create the PSK using one of two methods. You can create a random pre-shared key using the ipsec command:

[root@vpn2 tmp]# ipsec ranbits --continuous 128
0x33893a081b34d32a362a46c404ca32d8
[root@vpn2 tmp]#

Or, you can create them out of your head. Make them long (over 20 bytes), as in:

Nonebutourselvescanfreeourminds

Update /etc/ipsec.secrets by adding text in this format at the beginning of the file:

vpn1-ip-address vpn2-ip-address : PSK "key in quotations"

For the example the line is:

97.158.253.25 6.25.232.6 : PSK "nonebutourselvescanfreeourminds"

Update /etc/ipsec.conf. The PSK configuration is very similar to the RSA configuration with exception that the leftid, rightid, leftrsasigkey, and rightrsasigkey fields are omitted from the relevant conn subsection. Also add the authtype=secret command to the configuration:

    conn net-to-net
        authby=secret
        left=97.158.253.25
        leftsubnet=172.16.1.0/24
        leftnexthop=%defaultroute
        right=6.25.232.1
        rightsubnet=10.0.0.0/24
        rightnexthop=97.158.253.25
        auto=start