From fd5d7ff0b4fd69b248ecb29c6ec1f3cf844c41cf Mon Sep 17 00:00:00 2001
From: Lucas Christian <lucas@lucasec.com>
Date: Sat, 20 Jul 2024 19:29:14 -0700
Subject: T6599: ipsec: support disabling rekey of CHILD_SA.

Also adds support for life_bytes, life_packets, and DPD for
remote-access connections. Changes behavior of remote-access esp-group
lifetime setting to have parity with site-to-site connections.
---
 interface-definitions/vpn_ipsec.xml.in | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'interface-definitions/vpn_ipsec.xml.in')

diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index 7f425d982..4a7fde75b 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -99,6 +99,12 @@
                   </constraint>
                 </properties>
               </leafNode>
+              <leafNode name="disable-rekey">
+                <properties>
+                  <help>Do not locally initiate a re-key of the SA, remote peer must re-key before expiration</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
               <leafNode name="mode">
                 <properties>
                   <help>ESP mode</help>
-- 
cgit v1.2.3