summaryrefslogtreecommitdiff
path: root/data/templates/ipsec/swanctl/profile.j2
diff options
context:
space:
mode:
authorChristian Poessinger <christian@poessinger.com>2022-05-01 19:44:52 +0200
committerChristian Poessinger <christian@poessinger.com>2022-05-01 19:44:52 +0200
commit49b1afc25b73d9c5daae1c76edb88aab42afa83e (patch)
tree64d44eb5425ba0ebb0531f2cb60cef32830f0efa /data/templates/ipsec/swanctl/profile.j2
parent992c847493665fd2119636d81582aa80e99e388a (diff)
downloadvyos-1x-49b1afc25b73d9c5daae1c76edb88aab42afa83e.tar.gz
vyos-1x-49b1afc25b73d9c5daae1c76edb88aab42afa83e.zip
ipsec: T4353: fix Jinja2 linting errors
Diffstat (limited to 'data/templates/ipsec/swanctl/profile.j2')
-rw-r--r--data/templates/ipsec/swanctl/profile.j239
1 files changed, 39 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/profile.j2 b/data/templates/ipsec/swanctl/profile.j2
new file mode 100644
index 000000000..d4f417378
--- /dev/null
+++ b/data/templates/ipsec/swanctl/profile.j2
@@ -0,0 +1,39 @@
+{% macro conn(name, profile_conf, ike_group, esp_group) %}
+{# peer needs to reference the global IKE configuration for certain values #}
+{% set ike = ike_group[profile_conf.ike_group] %}
+{% set esp = esp_group[profile_conf.esp_group] %}
+{% if profile_conf.bind.tunnel is vyos_defined %}
+{% for interface in profile_conf.bind.tunnel %}
+ dmvpn-{{ name }}-{{ interface }} {
+ proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }}
+ version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
+ rekey_time = {{ ike.lifetime }}s
+ keyingtries = 0
+{% if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
+ local {
+ auth = psk
+ }
+ remote {
+ auth = psk
+ }
+{% endif %}
+ children {
+ dmvpn {
+ esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }}
+ rekey_time = {{ esp.lifetime }}s
+ rand_time = 540s
+ local_ts = dynamic[gre]
+ remote_ts = dynamic[gre]
+ mode = {{ esp.mode }}
+{% if ike.dead_peer_detection.action is vyos_defined %}
+ dpd_action = {{ ike.dead_peer_detection.action }}
+{% endif %}
+{% if esp.compression is vyos_defined('enable') %}
+ ipcomp = yes
+{% endif %}
+ }
+ }
+ }
+{% endfor %}
+{% endif %}
+{% endmacro %}