blob: 0360972f6caf79de30e833e5c42124ca60705821 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
|
{% macro conn(name, profile_conf, ike_group, esp_group) %}
{# peer needs to reference the global IKE configuration for certain values #}
{% set ike = ike_group[profile_conf.ike_group] %}
{% set esp = esp_group[profile_conf.esp_group] %}
{% if profile_conf.bind is defined and profile_conf.bind.tunnel is defined %}
{% for interface in profile_conf.bind.tunnel %}
dmvpn-{{ name }}-{{ interface }} {
proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }}
version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }}
rekey_time = {{ ike.lifetime if ike.lifetime is defined else '28800' }}s
keyingtries = 0
{% if profile_conf.authentication is defined and profile_conf.authentication.mode is defined and profile_conf.authentication.mode == 'pre-shared-secret' %}
local {
auth = psk
}
remote {
auth = psk
}
{% endif %}
children {
dmvpn {
esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }}
rekey_time = {{ esp.lifetime if esp.lifetime is defined else '3600' }}s
rand_time = 540s
local_ts = dynamic[gre]
remote_ts = dynamic[gre]
mode = {{ esp.mode if esp.mode is defined else 'transport' }}
{% if ike.dead_peer_detection is defined and ike.dead_peer_detection.action is defined %}
dpd_action = {{ ike.dead_peer_detection.action }}
{% endif %}
{% if esp.compression is defined and esp.compression == 'enable' %}
ipcomp = yes
{% endif %}
}
}
}
{% endfor %}
{% endif %}
{% endmacro %}
|
