diff options
Diffstat (limited to 'docs/configuration/vpn/ipsec.rst')
| -rw-r--r-- | docs/configuration/vpn/ipsec.rst | 39 |
1 files changed, 14 insertions, 25 deletions
diff --git a/docs/configuration/vpn/ipsec.rst b/docs/configuration/vpn/ipsec.rst index 327f3abb..b6ee86af 100644 --- a/docs/configuration/vpn/ipsec.rst +++ b/docs/configuration/vpn/ipsec.rst @@ -51,8 +51,6 @@ VyOS IKE group has the next options: * ``hold`` set action to hold; - * ``clear`` set action to clear; - * ``restart`` set action to restart; * ``dead-peer-detection`` controls the use of the Dead Peer Detection protocol @@ -73,11 +71,9 @@ VyOS IKE group has the next options: * ``timeout`` keep-alive timeout in seconds <2-86400> (default 120) IKEv1 only * ``ikev2-reauth`` whether rekeying of an IKE_SA should also reauthenticate - the peer. In IKEv1, reauthentication is always done: - - * ``yes`` enable remote host re-authentication during an IKE rekey; - - * ``no`` disable remote host re-authenticaton during an IKE rekey; + the peer. In IKEv1, reauthentication is always done. + Setting this parameter enables remote host re-authentication during an IKE + rekey. * ``key-exchange`` which protocol should be used to initialize the connection If not set both protocols are handled and connections will use IKEv2 when @@ -87,13 +83,10 @@ VyOS IKE group has the next options: * ``ikev2`` use IKEv2 for Key Exchange; -* ``lifetime`` IKE lifetime in seconds <30-86400> (default 28800); - -* ``mobike`` enable MOBIKE Support. MOBIKE is only available for IKEv2: +* ``lifetime`` IKE lifetime in seconds <0-86400> (default 28800); - * ``enable`` enable MOBIKE (default for IKEv2); - - * ``disable`` disable MOBIKE; +* ``disable-mobike`` disables MOBIKE Support. MOBIKE is only available for IKEv2 + and enabled by default. * ``mode`` IKEv1 Phase 1 Mode Selection: @@ -126,12 +119,8 @@ Multiple proposals can be specified in a single group. VyOS ESP group has the next options: -* ``compression`` whether IPComp compression of content is proposed - on the connection: - - * ``disable`` disable IPComp compression (default); - - * ``enable`` enable IPComp compression; +* ``compression`` Enables the IPComp(IP Payload Compression) protocol which + allows compressing the content of IP packets. * ``life-bytes`` ESP life in bytes <1024-26843545600000>. Number of bytes transmitted over an IPsec SA before it expires; @@ -172,11 +161,11 @@ Options (Global IPsec settings) Attributes * ``disable-route-autoinstall`` Do not automatically install routes to remote networks; - * ``flexvpn`` Allow FlexVPN vendor ID payload (IKEv2 only). Send the Cisco FlexVPN vendor ID payload (IKEv2 only), which is required in order to make Cisco brand devices allow negotiating a local traffic selector (from strongSwan's point of view) that is not the assigned virtual IP address if such an address is requested by strongSwan. Sending the Cisco FlexVPN vendor ID prevents the peer from narrowing the initiator's local traffic selector and allows it to e.g. negotiate a TS of 0.0.0.0/0 == 0.0.0.0/0 instead. This has been tested with a "tunnel mode ipsec ipv4" Cisco template but should also work for GRE encapsulation; + * ``flexvpn`` Allows FlexVPN vendor ID payload (IKEv2 only). Send the Cisco FlexVPN vendor ID payload (IKEv2 only), which is required in order to make Cisco brand devices allow negotiating a local traffic selector (from strongSwan's point of view) that is not the assigned virtual IP address if such an address is requested by strongSwan. Sending the Cisco FlexVPN vendor ID prevents the peer from narrowing the initiator's local traffic selector and allows it to e.g. negotiate a TS of 0.0.0.0/0 == 0.0.0.0/0 instead. This has been tested with a "tunnel mode ipsec ipv4" Cisco template but should also work for GRE encapsulation; * ``interface`` Interface Name to use. The name of the interface on which virtual IP addresses should be installed. If not specified the addresses will be installed on the outbound interface; - * ``virtual-ip`` Allow install virtual-ip addresses. Comma separated list of virtual IPs to request in IKEv2 configuration payloads or IKEv1 Mode Config. The wildcard addresses 0.0.0.0 and :: request an arbitrary address, specific addresses may be defined. The responder may return a different address, though, or none at all. + * ``virtual-ip`` Allows to install virtual-ip addresses. Comma separated list of virtual IPs to request in IKEv2 configuration payloads or IKEv1 Mode Config. The wildcard addresses 0.0.0.0 and :: request an arbitrary address, specific addresses may be defined. The responder may return a different address, though, or none at all. Define the ``virtual-address`` option to configure the IP address in site-to-site hierarchy. ************************* IPsec policy matching GRE @@ -232,8 +221,8 @@ On the LEFT: On the RIGHT, setup by analogy and swap local and remote addresses. -Source tunnel from loopbacks -^^^^^^^^^^^^^^^^^^^^^^^^^^^^ +Source tunnel from dummy interface +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ The scheme above doesn't work when one of the routers has a dynamic external address though. The classic workaround for this is to setup an address on a @@ -251,7 +240,7 @@ On the LEFT: .. code-block:: none - set interfaces loopback lo address 192.168.99.1/32 + set interfaces dummy dum0 address 192.168.99.1/32 set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 address 10.10.10.1/30 @@ -262,7 +251,7 @@ On the RIGHT: .. code-block:: none - set interfaces loopback lo address 192.168.99.2/32 + set interfaces dummy dum0 address 192.168.99.2/32 set interfaces tunnel tun0 encapsulation gre set interfaces tunnel tun0 address 10.10.10.2/30 |