vyos-1x.git/data/templates/ipsec, branch fix/T8955-http-api-verify-tls

ipsec: T8912: Fix log level not respected in system journal

2026-05-27T14:04:17+00:00

When setting 'vpn ipsec logging log-level 0', DPD informational messages (log level 1) were still appearing in the system journal. The root cause is that charon-systemd reads both `charon-systemd.conf` and `charon-logging.conf` and applies the higher of the two log levels to the journal. The VyOS only managed `charon-systemd.conf`, leaving `charon-logging.conf` at its default level of 1, which silently overrode the user-configured level. Fix this by rendering `charon-logging.conf` on every commit with syslog backend set to -1 (silent), making `charon-systemd.conf` the sole authoritative source for journal log verbosity. This also eliminates duplicate log entries in the journal that occurred when both backends were active and writing to the same destination.

ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers

2026-05-20T09:22:21+00:00

IKEv2 reauthentication was configurable via CLI but never translated into `swanctl.conf`. Add `reauth_time` to the peer connection template, driven by the `ikev2-reauth` flag on the ike-group and the per-peer override (yes/no/inherit).

T8410: Fix typos and mistakes for comments and messages

2026-03-27T15:00:17+00:00

Fix typos and mistakes No functional changes

T8386: fix locat_ts rendering in remote_access.j2

2026-03-17T07:02:03+00:00

T8136: IPSEC PPK Support

2026-03-04T04:48:18+00:00

ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`

2025-12-04T15:03:54+00:00

The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.

T8027: vpn: adding config for swanctl "send-cert always"

2025-11-22T02:22:43+00:00

This setting seems to be required for various Apple clients to connect to the IKEv2 IPSec VPN.

ipsec: T7562: Add support for `disable-uniqreqids` option in IPsec configs

2025-08-12T09:11:05+00:00

This commit makes `set vpn ipsec disable-uniqreqids` work with the modern StrongSwan backend by setting `unique=never` in swanctl.conf for connections. This restores legacy behavior about multiple connections with the same identity.

ipsec: T7581: Fix unsupported 'all' protocol in site-to-site tunnels after upgrade to 1.4.x

2025-07-28T08:43:42+00:00

Upgrading from VyOS 1.3.8 (strongSwan 5.7.2) to 1.4.x (strongSwan 5.9.11) caused the IPsec service to fail if the configuration contained: ``` set vpn ipsec site-to-site peer tunnel protocol 'all' ``` In 1.3.8, 'all' was supported in the CLI for protocol and converted internally to '%any' in ipsec.conf traffic selectors, allowing the tunnel to match all protocols. However, in 1.4.x and strongSwan 5.9.11+, the '[all/]' syntax is no longer supported, and use of 'protocol all' produces an invalid traffic selector (e.g., 'x.x.x.0/24[all/]'), causing the strongSwan service to fail on reload. This fix ensures that 'protocol all' is converted to just the subnet notation (e.g., 'x.x.x.0/24') in the generated traffic selector, restoring previous behavior and allowing seamless service startup after upgrade.

ipsec: T7504: Added IKEv2 retransmission options

2025-07-18T10:08:10+00:00

Added IKEv2 retransmission options (base, tries, timeout).