summaryrefslogtreecommitdiff
path: root/data/templates/ipsec/swanctl/remote_access.j2
diff options
context:
space:
mode:
authorLucas Christian <lucas@lucasec.com>2023-12-28 22:08:36 -0800
committerLucas Christian <lucas@lucasec.com>2024-04-11 21:12:34 -0700
commitecc83562b4d756cc50910561a3f52ec260aeb478 (patch)
treebcaca728b1c782108790989a5dd030c28d7a6251 /data/templates/ipsec/swanctl/remote_access.j2
parent00be89b76bc1b6ec0ce04dc7957a8dbc7a65065b (diff)
downloadvyos-1x-ecc83562b4d756cc50910561a3f52ec260aeb478.tar.gz
vyos-1x-ecc83562b4d756cc50910561a3f52ec260aeb478.zip
T5871: ipsec remote access VPN: specify "cacerts" for client auth.
Diffstat (limited to 'data/templates/ipsec/swanctl/remote_access.j2')
-rw-r--r--data/templates/ipsec/swanctl/remote_access.j25
1 files changed, 5 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2
index af7f2994e..adfa32bde 100644
--- a/data/templates/ipsec/swanctl/remote_access.j2
+++ b/data/templates/ipsec/swanctl/remote_access.j2
@@ -35,6 +35,11 @@
auth = {{ rw_conf.authentication.client_mode }}
eap_id = %any
{% endif %}
+{% if rw_conf.authentication.client_mode is vyos_defined('eap-tls') or rw_conf.authentication.client_mode is vyos_defined('x509') %}
+{# pass all configured CAs as filenames, separated by commas #}
+{# this will produce a string like "MyCA1.pem,MyCA2.pem" #}
+ cacerts = {{ '.pem,'.join(rw_conf.authentication.x509.ca_certificate) ~ '.pem' }}
+{% endif %}
}
children {
ikev2-vpn {