vyos-1x.git/data/templates/ipsec/swanctl/remote_access.tmpl, branch rollingVyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git)
https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling2022-05-01T17:44:52+00:00ipsec: T4353: fix Jinja2 linting errors2022-05-01T17:44:52+00:00Christian Poessingerchristian@poessinger.com2022-05-01T17:44:52+00:00urn:sha1:49b1afc25b73d9c5daae1c76edb88aab42afa83eipsec: T4333: migrate to new vyos_defined Jinja2 test2022-04-13T20:51:42+00:00Christian Poessingerchristian@poessinger.com2022-04-13T20:51:42+00:00urn:sha1:e8a637eec0cc398f78a877ece6b9c7cdca418970ipsec: T3828: Use IKE dh-group when ESP dh-group is set to `enable`2021-09-13T12:23:54+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2021-09-13T11:51:49+00:00urn:sha1:2e68b070f1531c87d5976213565d9b929c5589abipsec: T1210: Jinj2 template did not honor inactivity/timeout setting2021-08-27T09:05:14+00:00Christian Poessingerchristian@poessinger.com2021-08-27T09:04:36+00:00urn:sha1:cfd4d283ff0297372248b4ec57f67fd36dd33fc2ipsec: T1210: add missing if clause around unique key2021-08-20T11:57:16+00:00Christian Poessingerchristian@poessinger.com2021-08-20T11:57:16+00:00urn:sha1:2278785d4327c961a2c3a8e36637f4e464ad7230ipsec: T1210: add "unique" option to specify how to handle multiple connections2021-07-19T17:04:13+00:00Christian Poessingerchristian@poessinger.com2021-07-19T17:04:13+00:00urn:sha1:02043297db68d45b2ca398486cc119d1c103e68c
Connection uniqueness policy to enforce. To avoid multiple connections from the
same user, a uniqueness policy can be enforced.
* never: never enforce such a policy, even if a peer included INITIAL_CONTACT
notification
* keep: reject new connection attempts if the same user already has an active
connection
* replace: delete any existing connection if a new one for the same user gets
established
To compare connections for uniqueness, the remote IKE identity is used. If EAP
or XAuth authentication is involved, the EAP-Identity or XAuth username is used
to enforce the uniqueness policy instead.
ipsec: T1210: split out pool from remote-access configuration2021-07-19T17:01:43+00:00Christian Poessingerchristian@poessinger.com2021-07-19T17:01:43+00:00urn:sha1:9556d78b1d54c7320a0154990c61d23c6197c38f
Remote access IP pools can now be defined at a global level and referenced
in IPSec remote-access connections. To defined a pool use:
set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1'
set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24'
set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1'
set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64'
A connection can then reference the pool:
set vpn ipsec remote-access connection foo pool 'global-ipv4'
set vpn ipsec remote-access connection foo pool 'global-ipv6'
ipsec: T1210: remote-access pools can not hold both IPv4 and IPv6 prefixes2021-07-18T19:35:53+00:00Christian Poessingerchristian@poessinger.com2021-07-18T19:35:53+00:00urn:sha1:48c768abbf53b752a55db2adea1f998cb28da55c
... this enables a dual-stack IKEv2 VPN deployment.
ipsec: T1210: T1251: Add more features to remote-access connections2021-07-05T20:01:10+00:00sarthurdev965089+sarthurdev@users.noreply.github.com2021-07-05T14:22:54+00:00urn:sha1:0b93fce06526a2826c19adcbb25874e51cccf68e
- Adds client/server authentication methods.
- Adds basic verification to remote-access.
- Adds DHCP pool and options to remote-access.
- Cleanup unused PKI files.
ipsec: T1210: T1251: add "local" traffic-selector include definition2021-07-04T19:02:54+00:00Christian Poessingerchristian@poessinger.com2021-07-04T19:02:54+00:00urn:sha1:1c727bd25ef28fb729f66072f026be560978853d
Used by both site2site and remote-access/road-warrior VPN connections.