
<refsect1 id='implicit_conns'><title>IMPLICIT CONNS</title>
<para>The system automatically defines several conns to implement
default policy groups.  Each can be overridden by explicitly
defining a new conn with the same name.  If the new conn has <emphasis remap='B'>auto=ignore</emphasis>,
the definition is suppressed.</para>

<para>Here are the automatically supplied definitions.</para>

<!-- .ne 8 -->
<literallayout remap='.nf'>
<!-- .ta 1c -->
<emphasis remap='B'>
conn clear
	type=passthrough
	authby=never
	left=%defaultroute
	right=%group
	auto=route

conn clear-or-private
	type=passthrough
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn private-or-clear
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn private
	type=tunnel
	left=%defaultroute
	leftid=%myid
	right=%opportunisticgroup
	failureshunt=drop
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route

conn block
	type=reject
	authby=never
	left=%defaultroute
	right=%group
	auto=route

# default policy
conn packetdefault
	type=tunnel
	left=%defaultroute
	leftid=%myid
	left=0.0.0.0/0
	right=%opportunistic
	failureshunt=passthrough
	keyingtries=3
	ikelifetime=1h
	salifetime=1h
	rekey=no
	auto=route
</emphasis>
</literallayout> <!-- .fi -->

<para>These conns are <emphasis remap='I'>not</emphasis> affected by anything in <emphasis remap='B'>conn %default</emphasis>.
They will only work if <emphasis remap='B'>%defaultroute</emphasis> works.
The <emphasis remap='B'>leftid</emphasis> will be the interfaces IP address; this
requires that reverse DNS records be set up properly.</para>

<para>The implicit conns are defined after all others.  It is
appropriate and reasonable to use <emphasis remap='B'>also=private-or-clear</emphasis>
(for example) in any other opportunistic conn.</para>
</refsect1>

<refsect1 id='policy_group_files'><title>POLICY GROUP FILES</title>
<para>The optional files under 
<filename>/etc/ipsec.d/policy</filename>,
including</para>
<literallayout remap='.nf'>

/etc/ipsec.d/policies/clear
/etc/ipsec.d/policies/clear-or-private
/etc/ipsec.d/policies/private-or-clear
/etc/ipsec.d/policies/private
/etc/ipsec.d/policies/block

</literallayout> <!-- .fi -->
<para>may contain policy group configuration information to 
supplement 
<emphasis remap='I'>ipsec.conf</emphasis>.
Their contents are not security-sensitive.</para>

<para>These files are text files.
Each consists of a list of CIDR blocks, one per line.
White space followed by # followed by anything to the end of the line
is a comment and is ignored, as are empty lines.</para>

<para>A connection in
<filename>ipsec.conf</filename>
which has
<emphasis remap='B'>right=%group</emphasis>
or 
<emphasis remap='B'>right=%opportunisticgroup</emphasis>
is a policy group connection.
When a policy group file of the same name is loaded, with</para>

<para>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<emphasis remap='B'>ipsec auto --rereadgroups</emphasis></para> 

<para>or at system start, the connection is instantiated such that each
CIDR block serves as an instance's 
<emphasis remap='B'>right</emphasis>
value. The system treats the
resulting instances as normal connections.</para>

<para>For example, given a suitable connection definition 
<emphasis remap='B'>private</emphasis>,
and the file
<filename>/etc/ipsec.d/policy/private</filename>
with an entry 192.0.2.3,
the system creates a connection instance 
<emphasis remap='B'>private#192.0.2.3.</emphasis>
This connection inherits all details from 
<emphasis remap='B'>private</emphasis>,
except that its right client is 192.0.2.3.</para>
</refsect1>

<refsect1 id='default_policy_groups'><title>DEFAULT POLICY GROUPS</title>
<para>The standard Libreswan install includes several policy groups
which provide a way of classifying possible peers into IPsec security classes:
<emphasis remap='B'>private</emphasis>
(talk encrypted only),
<emphasis remap='B'>private-or-clear</emphasis>
(prefer encryption),
<emphasis remap='B'>clear-or-private</emphasis>
(respond to requests for encryption), 
<emphasis remap='B'>clear</emphasis>
and
<emphasis remap='B'>block</emphasis>.
Implicit policy groups apply to the local host only,
and are implemented by the
<emphasis remap='B'>IMPLICIT CONNECTIONS</emphasis>
described above.</para>
</refsect1>

