diff options
| author | Christian Breunig <christian@breunig.cc> | 2025-03-07 10:31:35 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-03-07 10:31:35 +0100 |
| commit | c65d443fd2c3f716b7c2154d541d0b4faf25b531 (patch) | |
| tree | 59e1573c154165a4d6c14977c1cb6f66b79966ad | |
| parent | 4a5fbf5e2c809d3e108fc8e9ed93ef261ceee3dd (diff) | |
| parent | c31df5a5b5c1d1dfee063fe63a610c8bf71271f0 (diff) | |
| download | vyos-1x-c65d443fd2c3f716b7c2154d541d0b4faf25b531.tar.gz vyos-1x-c65d443fd2c3f716b7c2154d541d0b4faf25b531.zip | |
Merge pull request #4382 from c-po/ipsec-ios-profile-fixes
ipsec: T7225: fix IKE DiffieHellmanGroup and ExtendedAuthEnabled in iOS profile
| -rw-r--r-- | data/templates/ipsec/ios_profile.j2 | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/data/templates/ipsec/ios_profile.j2 b/data/templates/ipsec/ios_profile.j2 index eaf00018b..6993f82bf 100644 --- a/data/templates/ipsec/ios_profile.j2 +++ b/data/templates/ipsec/ios_profile.j2 @@ -55,11 +55,9 @@ <!-- The server is authenticated using a certificate --> <key>AuthenticationMethod</key> <string>Certificate</string> -{% if authentication.client_mode is vyos_defined and authentication.client_mode.startswith("eap") %} <!-- The client uses EAP to authenticate --> <key>ExtendedAuthEnabled</key> <integer>1</integer> -{% endif %} <!-- The next two dictionaries are optional (as are the keys in them), but it is recommended to specify them as the default is to use 3DES. IMPORTANT: Because only one proposal is sent (even if nothing is configured here) it must match the server configuration --> <key>IKESecurityAssociationParameters</key> @@ -80,9 +78,9 @@ <string>{{ esp_encryption.encryption }}</string> <key>IntegrityAlgorithm</key> <string>{{ esp_encryption.hash }}</string> -{% if esp_encryption.pfs is vyos_defined %} +{% if ike_encryption.dh_group is vyos_defined %} <key>DiffieHellmanGroup</key> - <integer>{{ esp_encryption.pfs }}</integer> + <integer>{{ ike_encryption.dh_group }}</integer> {% endif %} </dict> <!-- Controls whether the client offers Perfect Forward Secrecy (PFS). This should be set to match the server. --> |