diff options
| author | Christian Poessinger <christian@poessinger.com> | 2021-07-19 19:01:43 +0200 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2021-07-19 19:01:43 +0200 |
| commit | 9556d78b1d54c7320a0154990c61d23c6197c38f (patch) | |
| tree | b04a677d46bc5e4055b96452f73ca44de392cb2f /data/templates/ipsec/swanctl/remote_access.tmpl | |
| parent | 48c768abbf53b752a55db2adea1f998cb28da55c (diff) | |
| download | vyos-1x-9556d78b1d54c7320a0154990c61d23c6197c38f.tar.gz vyos-1x-9556d78b1d54c7320a0154990c61d23c6197c38f.zip | |
ipsec: T1210: split out pool from remote-access configuration
Remote access IP pools can now be defined at a global level and referenced
in IPSec remote-access connections. To defined a pool use:
set vpn ipsec remote-access pool global-ipv4 name-server '172.16.1.1'
set vpn ipsec remote-access pool global-ipv4 prefix '192.168.0.0/24'
set vpn ipsec remote-access pool global-ipv6 name-server '2001:db8::1'
set vpn ipsec remote-access pool global-ipv6 prefix '2001:db8:1000::/64'
A connection can then reference the pool:
set vpn ipsec remote-access connection foo pool 'global-ipv4'
set vpn ipsec remote-access connection foo pool 'global-ipv6'
Diffstat (limited to 'data/templates/ipsec/swanctl/remote_access.tmpl')
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.tmpl | 17 |
1 files changed, 4 insertions, 13 deletions
diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl index ea79a6d6b..66ac94b13 100644 --- a/data/templates/ipsec/swanctl/remote_access.tmpl +++ b/data/templates/ipsec/swanctl/remote_access.tmpl @@ -10,18 +10,9 @@ send_certreq = no rekey_time = {{ ike.lifetime }}s keyingtries = 0 -{% if rw_conf.pool is defined and rw_conf.pool.dhcp_enable is defined %} - pools = dhcp -{% elif rw_conf.pool is defined and rw_conf.pool.prefix is defined and rw_conf.pool.prefix is not none %} -{% set pool = namespace(name='') %} -{% for prefix in rw_conf.pool.prefix %} -{% if not loop.first %} -{% set pool.name = pool.name ~ ',' %} -{% endif %} -{% set afi = '-ipv4' if prefix | is_ipv4 else '-ipv6' %} -{% set pool.name = pool.name + 'ra-' + name + afi %} -{% endfor %} - pools = {{ pool.name }} + unique = never +{% if rw_conf.pool is defined and rw_conf.pool is not none %} + pools = {{ rw_conf.pool | join(',') }} {% endif %} local { {% if rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %} @@ -42,7 +33,7 @@ } children { ikev2-vpn { - esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} + esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} rekey_time = {{ esp.lifetime }}s rand_time = 540s dpd_action = clear |