vyos-1x.git/data/templates/ipsec, branch rolling

ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers

2026-09-16T08:22:40+00:00

VyOS does not expose the strongSwan `connections..unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own.

ipsec: T9254: split get_esp_ike_cipher() into get_esp_cipher() / get_ike_cipher()

2026-09-14T08:19:12+00:00

get_esp_ike_cipher() took an esn flag defaulting to True (ESP/CHILD_SA semantics), and every IKE_SA call site had to remember to pass esn=False. Nothing enforced that, so a future call site could reintroduce the ESN-in-IKE bug this task fixed. Following review feedback from hedrok, split it into two public filters: get_esp_cipher(group_config, ike_group=None) ESP/CHILD_SA, esn=True get_ike_cipher(group_config) IKE_SA, esn=False always The shared implementation moves to _get_esp_ike_cipher() (no register_filter), so a template can no longer call it directly and skip picking one of the two entry points. Updated call sites: peer.j2, profile.j2, remote_access.j2, l2tp.j2 (proposals -> get_ike_cipher, esp_proposals -> get_esp_cipher), and test_template.py.

ipsec: T9254: do not emit ESN transforms in IKE proposals

2026-08-31T17:57:40+00:00

get_esp_ike_cipher() renders both IKE_SA proposals and CHILD_SA proposals. It unconditionally appended the -esn / -noesn variants, which are only meaningful for ESP: ESN is Transform Type 5 per RFC 7296 section 3.3.2 and is defined for CHILD_SAs only. Emitting ESN in an IKE_SA proposal breaks interoperability with implementations that reject the malformed payload without replying at all. Observed against a Cisco FTD: the IKE_SA_INIT is silently discarded, no NO_PROPOSAL_CHOSEN and no INVALID_KE_PAYLOAD, so the tunnel never comes up and nothing on the initiator side explains it. Add an explicit esn parameter defaulting to True so ESP behaviour is unchanged, and pass esn=False at the four IKE call sites: peer.j2, profile.j2, remote_access.j2 and l2tp.j2. The five esp_proposals call sites keep ESN. ike_group could have served as the discriminator, since IKE call sites do not pass it, but that coupling is incidental: the argument only exists to resolve PFS. Smoke test assertions on the proposals lines are updated accordingly; the esp_proposals assertions are left untouched.

ipsec: T8912: Fix log level not respected in system journal

2026-05-27T14:04:17+00:00

When setting 'vpn ipsec logging log-level 0', DPD informational messages (log level 1) were still appearing in the system journal. The root cause is that charon-systemd reads both `charon-systemd.conf` and `charon-logging.conf` and applies the higher of the two log levels to the journal. The VyOS only managed `charon-systemd.conf`, leaving `charon-logging.conf` at its default level of 1, which silently overrode the user-configured level. Fix this by rendering `charon-logging.conf` on every commit with syslog backend set to -1 (silent), making `charon-systemd.conf` the sole authoritative source for journal log verbosity. This also eliminates duplicate log entries in the journal that occurred when both backends were active and writing to the same destination.

ipsec: T7555: Implement `ikev2-reauth` for site-to-site peers

2026-05-20T09:22:21+00:00

IKEv2 reauthentication was configurable via CLI but never translated into `swanctl.conf`. Add `reauth_time` to the peer connection template, driven by the `ikev2-reauth` flag on the ike-group and the per-peer override (yes/no/inherit).

T8410: Fix typos and mistakes for comments and messages

2026-03-27T15:00:17+00:00

Fix typos and mistakes No functional changes

T8386: fix locat_ts rendering in remote_access.j2

2026-03-17T07:02:03+00:00

T8136: IPSEC PPK Support

2026-03-04T04:48:18+00:00

ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`

2025-12-04T15:03:54+00:00

The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops.

T8027: vpn: adding config for swanctl "send-cert always"

2025-11-22T02:22:43+00:00

This setting seems to be required for various Apple clients to connect to the IKEv2 IPSec VPN.