vyos-1x.git/data/templates/ipsec/swanctl, branch rolling

ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers

2026-05-20T09:22:21+00:00

IKEv2 reauthentication was configurable via CLI but never translated into `swanctl.conf`. Add `reauth_time` to the peer connection template, driven by the `ikev2-reauth` flag on the ike-group and the per-peer override (yes/no/inherit).

T8386: fix locat_ts rendering in remote_access.j2

2026-03-17T07:02:03+00:00

T8136: IPSEC PPK Support

2026-03-04T04:48:18+00:00

ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`

2025-12-04T15:03:54+00:00

The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.

T8027: vpn: adding config for swanctl "send-cert always"

2025-11-22T02:22:43+00:00

This setting seems to be required for various Apple clients to connect to the IKEv2 IPSec VPN.

ipsec: T7562: Add support for `disable-uniqreqids` option in IPsec configs

2025-08-12T09:11:05+00:00

This commit makes `set vpn ipsec disable-uniqreqids` work with the modern StrongSwan backend by setting `unique=never` in swanctl.conf for connections. This restores legacy behavior about multiple connections with the same identity.

ipsec: T7581: Fix unsupported 'all' protocol in site-to-site tunnels after upgrade to 1.4.x

2025-07-28T08:43:42+00:00

Upgrading from VyOS 1.3.8 (strongSwan 5.7.2) to 1.4.x (strongSwan 5.9.11) caused the IPsec service to fail if the configuration contained: ``` set vpn ipsec site-to-site peer tunnel protocol 'all' ``` In 1.3.8, 'all' was supported in the CLI for protocol and converted internally to '%any' in ipsec.conf traffic selectors, allowing the tunnel to match all protocols. However, in 1.4.x and strongSwan 5.9.11+, the '[all/]' syntax is no longer supported, and use of 'protocol all' produces an invalid traffic selector (e.g., 'x.x.x.0/24[all/]'), causing the strongSwan service to fail on reload. This fix ensures that 'protocol all' is converted to just the subnet notation (e.g., 'x.x.x.0/24') in the generated traffic selector, restoring previous behavior and allowing seamless service startup after upgrade.

T7343: IPsec add traffic-selector handling for VTI interfaces

2025-04-17T09:45:46+00:00

Allow to set traffic-selector for VTI interfaces We can set several local and remote IPv4 and IPv6 prefixes ``` set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix 0.0.0.0/0 set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix :/0 set vpn ipsec site-to-site peer P1 vti traffic-selector remote prefix 192.0.2.0/24 ```

nhrp: T2326: NHRP migration to FRR

2025-01-09T16:24:15+00:00

NHRP migration to FRR

T5873: vpn ipsec remote-access: improve child ESP session naming

2024-07-27T01:26:30+00:00