smoketest: config: azure: also utilize "default-esp-group" feature

(cherry-picked from commit 57fa30de709afe31aeddb5fedf565ce44c5ba937)

1 files changed, 436 insertions, 435 deletions

diff --git a/smoketest/configs/azure-bgp-gateway b/smoketest/configs/bgp-azure-ipsec-gateway
index b3f5e9edc..ddcd459ae 100644
--- a/smoketest/configs/azure-bgp-gateway
+++ b/smoketest/configs/bgp-azure-ipsec-gateway
@@ -1,435 +1,436 @@
-firewall {

-    all-ping enable

-    broadcast-ping disable

-    config-trap disable

-    ipv6-receive-redirects disable

-    ipv6-src-route disable

-    ip-src-route disable

-    log-martians disable

-    options {

-        interface vti31 {

-            adjust-mss 1350

-        }

-        interface vti32 {

-            adjust-mss 1350

-        }

-        interface vti41 {

-            adjust-mss 1350

-        }

-        interface vti42 {

-            adjust-mss 1350

-        }

-        interface vti51 {

-            adjust-mss 1350

-        }

-        interface vti52 {

-            adjust-mss 1350

-        }

-    }

-    receive-redirects disable

-    send-redirects enable

-    source-validation disable

-    syn-cookies enable

-    twa-hazards-protection disable

-}

-high-availability {

-    vrrp {

-        group DMZ-VLAN-3962 {

-            interface eth1

-            preempt-delay 180

-            priority 200

-            virtual-address 192.168.34.36/27

-            vrid 62

-        }

-    }

-}

-interfaces {

-    ethernet eth0 {

-        address 192.0.2.189/27

-        duplex auto

-        smp-affinity auto

-        speed auto

-    }

-    ethernet eth1 {

-        address 192.168.34.37/27

-        duplex auto

-        smp-affinity auto

-        speed auto

-    }

-    loopback lo {

-    }

-    vti vti31 {

-    }

-    vti vti32 {

-    }

-    vti vti41 {

-    }

-    vti vti42 {

-    }

-    vti vti51 {

-    }

-    vti vti52 {

-    }

-}

-policy {

-    prefix-list AZURE-BGP-IPv4-in {

-        description "Prefixes received from Azure"

-        rule 100 {

-            action permit

-            le 32

-            prefix 100.64.0.0/10

-        }

-    }

-    prefix-list ONPREM-BGP-IPv4-out {

-        description "Prefixes allowed to be announced into Azure"

-        rule 100 {

-            action permit

-            prefix 10.0.0.0/8

-        }

-        rule 200 {

-            action permit

-            prefix 172.16.0.0/12

-        }

-        rule 300 {

-            action permit

-            prefix 192.168.0.0/16

-        }

-    }

-}

-protocols {

-    bgp 65522 {

-        address-family {

-            ipv4-unicast {

-                network 10.0.0.0/8 {

-                }

-                network 172.16.0.0/12 {

-                }

-                network 192.168.0.0/16 {

-                }

-            }

-        }

-        neighbor 100.66.8.36 {

-            peer-group AZURE

-            remote-as 64517

-        }

-        neighbor 100.66.8.37 {

-            peer-group AZURE

-            remote-as 64517

-        }

-        neighbor 100.66.24.36 {

-            peer-group AZURE

-            remote-as 64513

-        }

-        neighbor 100.66.24.37 {

-            peer-group AZURE

-            remote-as 64513

-        }

-        neighbor 100.66.40.36 {

-            peer-group AZURE

-            remote-as 64515

-        }

-        neighbor 100.66.40.37 {

-            peer-group AZURE

-            remote-as 64515

-        }

-        neighbor 192.168.34.38 {

-            address-family {

-                ipv4-unicast {

-                    nexthop-self

-                    soft-reconfiguration {

-                        inbound

-                    }

-                }

-            }

-            capability {

-                dynamic

-            }

-            password VyOSR0xx123

-            remote-as 65522

-            update-source eth1

-        }

-        peer-group AZURE {

-            address-family {

-                ipv4-unicast {

-                    maximum-prefix 50

-                    prefix-list {

-                        export ONPREM-BGP-IPv4-out

-                        import AZURE-BGP-IPv4-in

-                    }

-                }

-            }

-            ebgp-multihop 2

-            update-source eth1

-        }

-        timers {

-            holdtime 30

-            keepalive 5

-        }

-    }

-    static {

-        interface-route 100.66.8.36/32 {

-            next-hop-interface vti31 {

-            }

-            next-hop-interface vti32 {

-            }

-        }

-        interface-route 100.66.8.37/32 {

-            next-hop-interface vti31 {

-            }

-            next-hop-interface vti32 {

-            }

-        }

-        interface-route 100.66.24.36/32 {

-            next-hop-interface vti41 {

-            }

-            next-hop-interface vti42 {

-            }

-        }

-        interface-route 100.66.24.37/32 {

-            next-hop-interface vti41 {

-            }

-            next-hop-interface vti42 {

-            }

-        }

-        interface-route 100.66.40.36/32 {

-            next-hop-interface vti51 {

-            }

-            next-hop-interface vti52 {

-            }

-        }

-        interface-route 100.66.40.37/32 {

-            next-hop-interface vti51 {

-            }

-            next-hop-interface vti52 {

-            }

-        }

-        route 0.0.0.0/0 {

-            next-hop 192.168.34.33 {

-            }

-        }

-        route 51.105.0.0/16 {

-            next-hop 192.0.2.161 {

-            }

-        }

-        route 52.143.0.0/16 {

-            next-hop 192.0.2.161 {

-            }

-        }

-        route 195.137.175.0/24 {

-            next-hop 192.0.2.161 {

-            }

-        }

-        route 212.23.159.0/26 {

-            next-hop 192.0.2.161 {

-            }

-        }

-    }

-}

-service {

-    ssh {

-        disable-host-validation

-        port 22

-    }

-}

-system {

-    config-management {

-        commit-revisions 100

-    }

-    console {

-        device ttyS0 {

-            speed 115200

-        }

-    }

-    domain-name vyos.net

-    flow-accounting {

-        interface eth1

-        interface vti31

-        interface vti32

-        interface vti41

-        interface vti42

-        interface vti51

-        interface vti52

-        netflow {

-            server 10.0.1.1 {

-                port 2055

-            }

-            source-ip 192.168.34.37

-            version 10

-        }

-        syslog-facility daemon

-    }

-    host-name azure-gw-01

-    login {

-        radius-server 192.0.2.253 {

-            port 1812

-            secret secret1234

-            timeout 2

-        }

-        radius-server 192.0.2.254 {

-            port 1812

-            secret secret1234

-            timeout 2

-        }

-        radius-source-address 192.168.34.37

-        user vyos {

-            authentication {

-                encrypted-password $6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0

-                plaintext-password ""

-            }

-        }

-    }

-    name-server 192.0.2.254

-    ntp {

-        server 192.0.2.254 {

-        }

-    }

-    syslog {

-        global {

-            archive {

-                file 10

-                size 20480

-            }

-            facility all {

-                level info

-            }

-            facility protocols {

-                level debug

-            }

-        }

-        host 10.0.9.188 {

-            facility all {

-                level info

-                protocol udp

-            }

-        }

-    }

-    time-zone Europe/Berlin

-}

-vpn {

-    ipsec {

-        esp-group ESP-AZURE {

-            compression disable

-            lifetime 27000

-            mode tunnel

-            pfs disable

-            proposal 1 {

-                encryption aes256

-                hash sha1

-            }

-        }

-        ike-group IKE-AZURE {

-            close-action none

-            dead-peer-detection {

-                action restart

-                interval 2

-                timeout 15

-            }

-            ikev2-reauth no

-            key-exchange ikev2

-            lifetime 27000

-            proposal 1 {

-                dh-group 2

-                encryption aes256

-                hash sha1

-            }

-        }

-        ipsec-interfaces {

-            interface eth0

-        }

-        logging {

-            log-level 2

-            log-modes ike

-        }

-        site-to-site {

-            peer 51.105.0.2 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti51

-                    esp-group ESP-AZURE

-                }

-            }

-            peer 51.105.0.3 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti52

-                    esp-group ESP-AZURE

-                }

-            }

-            peer 51.105.0.246 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti32

-                    esp-group ESP-AZURE

-                }

-            }

-            peer 51.105.0.247 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti31

-                    esp-group ESP-AZURE

-                }

-            }

-            peer 51.105.0.18 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti42

-                    esp-group ESP-AZURE

-                }

-            }

-            peer 51.105.0.19 {

-                authentication {

-                    mode pre-shared-secret

-                    pre-shared-secret averysecretpsktowardsazure

-                }

-                connection-type respond

-                ike-group IKE-AZURE

-                ikev2-reauth inherit

-                local-address 192.0.2.189

-                vti {

-                    bind vti41

-                    esp-group ESP-AZURE

-                }

-            }

-        }

-    }

-}

-

-

-/* Warning: Do not remove the following line. */

-/* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@9:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */

-/* Release version: 1.2.5 */

+firewall {
+    all-ping enable
+    broadcast-ping disable
+    config-trap disable
+    ipv6-receive-redirects disable
+    ipv6-src-route disable
+    ip-src-route disable
+    log-martians disable
+    options {
+        interface vti31 {
+            adjust-mss 1350
+        }
+        interface vti32 {
+            adjust-mss 1350
+        }
+        interface vti41 {
+            adjust-mss 1350
+        }
+        interface vti42 {
+            adjust-mss 1350
+        }
+        interface vti51 {
+            adjust-mss 1350
+        }
+        interface vti52 {
+            adjust-mss 1350
+        }
+    }
+    receive-redirects disable
+    send-redirects enable
+    source-validation disable
+    syn-cookies enable
+    twa-hazards-protection disable
+}
+high-availability {
+    vrrp {
+        group DMZ-VLAN-3962 {
+            interface eth1
+            preempt-delay 180
+            priority 200
+            virtual-address 192.168.34.36/27
+            vrid 62
+        }
+    }
+}
+interfaces {
+    ethernet eth0 {
+        address 192.0.2.189/27
+        duplex auto
+        smp-affinity auto
+        speed auto
+    }
+    ethernet eth1 {
+        address 192.168.34.37/27
+        duplex auto
+        smp-affinity auto
+        speed auto
+    }
+    loopback lo {
+    }
+    vti vti31 {
+    }
+    vti vti32 {
+    }
+    vti vti41 {
+    }
+    vti vti42 {
+    }
+    vti vti51 {
+    }
+    vti vti52 {
+    }
+}
+policy {
+    prefix-list AZURE-BGP-IPv4-in {
+        description "Prefixes received from Azure"
+        rule 100 {
+            action permit
+            le 32
+            prefix 100.64.0.0/10
+        }
+    }
+    prefix-list ONPREM-BGP-IPv4-out {
+        description "Prefixes allowed to be announced into Azure"
+        rule 100 {
+            action permit
+            prefix 10.0.0.0/8
+        }
+        rule 200 {
+            action permit
+            prefix 172.16.0.0/12
+        }
+        rule 300 {
+            action permit
+            prefix 192.168.0.0/16
+        }
+    }
+}
+protocols {
+    bgp 65522 {
+        address-family {
+            ipv4-unicast {
+                network 10.0.0.0/8 {
+                }
+                network 172.16.0.0/12 {
+                }
+                network 192.168.0.0/16 {
+                }
+            }
+        }
+        neighbor 100.66.8.36 {
+            peer-group AZURE
+            remote-as 64517
+        }
+        neighbor 100.66.8.37 {
+            peer-group AZURE
+            remote-as 64517
+        }
+        neighbor 100.66.24.36 {
+            peer-group AZURE
+            remote-as 64513
+        }
+        neighbor 100.66.24.37 {
+            peer-group AZURE
+            remote-as 64513
+        }
+        neighbor 100.66.40.36 {
+            peer-group AZURE
+            remote-as 64515
+        }
+        neighbor 100.66.40.37 {
+            peer-group AZURE
+            remote-as 64515
+        }
+        neighbor 192.168.34.38 {
+            address-family {
+                ipv4-unicast {
+                    nexthop-self
+                    soft-reconfiguration {
+                        inbound
+                    }
+                }
+            }
+            capability {
+                dynamic
+            }
+            password VyOSR0xx123
+            remote-as 65522
+            update-source eth1
+        }
+        peer-group AZURE {
+            address-family {
+                ipv4-unicast {
+                    maximum-prefix 50
+                    prefix-list {
+                        export ONPREM-BGP-IPv4-out
+                        import AZURE-BGP-IPv4-in
+                    }
+                }
+            }
+            ebgp-multihop 2
+            update-source eth1
+        }
+        timers {
+            holdtime 30
+            keepalive 5
+        }
+    }
+    static {
+        interface-route 100.66.8.36/32 {
+            next-hop-interface vti31 {
+            }
+            next-hop-interface vti32 {
+            }
+        }
+        interface-route 100.66.8.37/32 {
+            next-hop-interface vti31 {
+            }
+            next-hop-interface vti32 {
+            }
+        }
+        interface-route 100.66.24.36/32 {
+            next-hop-interface vti41 {
+            }
+            next-hop-interface vti42 {
+            }
+        }
+        interface-route 100.66.24.37/32 {
+            next-hop-interface vti41 {
+            }
+            next-hop-interface vti42 {
+            }
+        }
+        interface-route 100.66.40.36/32 {
+            next-hop-interface vti51 {
+            }
+            next-hop-interface vti52 {
+            }
+        }
+        interface-route 100.66.40.37/32 {
+            next-hop-interface vti51 {
+            }
+            next-hop-interface vti52 {
+            }
+        }
+        route 0.0.0.0/0 {
+            next-hop 192.168.34.33 {
+            }
+        }
+        route 51.105.0.0/16 {
+            next-hop 192.0.2.161 {
+            }
+        }
+        route 52.143.0.0/16 {
+            next-hop 192.0.2.161 {
+            }
+        }
+        route 195.137.175.0/24 {
+            next-hop 192.0.2.161 {
+            }
+        }
+        route 212.23.159.0/26 {
+            next-hop 192.0.2.161 {
+            }
+        }
+    }
+}
+service {
+    ssh {
+        disable-host-validation
+        port 22
+    }
+}
+system {
+    config-management {
+        commit-revisions 100
+    }
+    console {
+        device ttyS0 {
+            speed 115200
+        }
+    }
+    domain-name vyos.net
+    flow-accounting {
+        interface eth1
+        interface vti31
+        interface vti32
+        interface vti41
+        interface vti42
+        interface vti51
+        interface vti52
+        netflow {
+            server 10.0.1.1 {
+                port 2055
+            }
+            source-ip 192.168.34.37
+            version 10
+        }
+        syslog-facility daemon
+    }
+    host-name azure-gw-01
+    login {
+        radius-server 192.0.2.253 {
+            port 1812
+            secret secret1234
+            timeout 2
+        }
+        radius-server 192.0.2.254 {
+            port 1812
+            secret secret1234
+            timeout 2
+        }
+        radius-source-address 192.168.34.37
+        user vyos {
+            authentication {
+                encrypted-password $6$O5gJRlDYQpj$MtrCV9lxMnZPMbcxlU7.FI793MImNHznxGoMFgm3Q6QP3vfKJyOSRCt3Ka/GzFQyW1yZS4NS616NLHaIPPFHc0
+                plaintext-password ""
+            }
+        }
+    }
+    name-server 192.0.2.254
+    ntp {
+        server 192.0.2.254 {
+        }
+    }
+    syslog {
+        global {
+            archive {
+                file 10
+                size 20480
+            }
+            facility all {
+                level info
+            }
+            facility protocols {
+                level debug
+            }
+        }
+        host 10.0.9.188 {
+            facility all {
+                level info
+                protocol udp
+            }
+        }
+    }
+    time-zone Europe/Berlin
+}
+vpn {
+    ipsec {
+        auto-update 120
+        esp-group ESP-AZURE {
+            compression disable
+            lifetime 27000
+            mode tunnel
+            pfs disable
+            proposal 1 {
+                encryption aes256
+                hash sha1
+            }
+        }
+        ike-group IKE-AZURE {
+            close-action none
+            dead-peer-detection {
+                action restart
+                interval 2
+                timeout 15
+            }
+            ikev2-reauth no
+            key-exchange ikev2
+            lifetime 27000
+            proposal 1 {
+                dh-group 2
+                encryption aes256
+                hash sha1
+            }
+        }
+        ipsec-interfaces {
+            interface eth0
+        }
+        logging {
+            log-level 2
+            log-modes ike
+        }
+        site-to-site {
+            peer 51.105.0.1 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                default-esp-group ESP-AZURE
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti51
+                }
+            }
+            peer 51.105.0.2 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                default-esp-group ESP-AZURE
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti52
+                }
+            }
+            peer 51.105.0.3 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti32
+                    esp-group ESP-AZURE
+                }
+            }
+            peer 51.105.0.4 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti31
+                    esp-group ESP-AZURE
+                }
+            }
+            peer 51.105.0.5 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti42
+                    esp-group ESP-AZURE
+                }
+            }
+            peer 51.105.0.6 {
+                authentication {
+                    mode pre-shared-secret
+                    pre-shared-secret averysecretpsktowardsazure
+                }
+                connection-type respond
+                ike-group IKE-AZURE
+                ikev2-reauth inherit
+                local-address 192.0.2.189
+                vti {
+                    bind vti41
+                    esp-group ESP-AZURE
+                }
+            }
+        }
+    }
+}
+
+
+/* Warning: Do not remove the following line. */
+/* === vyatta-config-version: "broadcast-relay@1:cluster@1:config-management@1:conntrack-sync@1:conntrack@1:dhcp-relay@2:dhcp-server@5:dns-forwarding@1:firewall@5:ipsec@5:l2tp@1:mdns@1:nat@4:ntp@1:pptp@1:qos@1:quagga@6:snmp@1:ssh@1:system@9:vrrp@2:wanloadbalance@3:webgui@1:webproxy@1:webproxy@2:zone-policy@1" === */
+/* Release version: 1.2.5 */