vyos-1x.git/interface-definitions/include/vpn-ipsec-unique.xml.i, branch rolling VyOS command definitions, scripts, and utilities (mirror of https://github.com/vyos/vyos-1x.git) https://git.amelek.net/vyos/vyos-1x.git/atom?h=rolling 2026-09-16T08:22:40+00:00 ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers 2026-09-16T08:22:40+00:00 Oleksandr Kuchmystyi o.kuchmystyi@vyos.io 2026-09-15T09:10:16+00:00 urn:sha1:d1cc3ed65eb1f00409d0b91fc8149431fb614e89 VyOS does not expose the strongSwan `connections.<conn>.unique` parameter for site-to-site peers. The swanctl default is `unique = no`, which only replaces existing SAs if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`, charon initiates new IKE_SAs without `INITIAL_CONTACT`, so duplicates accumulate on every DPD timeout. Previously the strongSwan `unique` connection policy could only be driven by the global "disable-uniqreqids" option, which set it to "never" for every connection. Site-to-site peers had no way to opt into stricter enforcement on their own.