diff options
| author | sarthurdev <965089+sarthurdev@users.noreply.github.com> | 2021-07-04 17:17:54 +0200 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2021-07-04 20:46:30 +0200 |
| commit | 79f1c891f3ae72fae3028f114e652225a082d9ef (patch) | |
| tree | 62bb06ced4406e27417d57ad298f52afa1feebb1 /data/templates/ipsec | |
| parent | b2bf1592189fb9298f2a68272418a132a73f37bf (diff) | |
| download | vyos-1x-79f1c891f3ae72fae3028f114e652225a082d9ef.tar.gz vyos-1x-79f1c891f3ae72fae3028f114e652225a082d9ef.zip | |
ipsec: T1210: T1251: extend ra config with address pools/traffic selectors
Diffstat (limited to 'data/templates/ipsec')
| -rw-r--r-- | data/templates/ipsec/swanctl.conf.tmpl | 14 | ||||
| -rw-r--r-- | data/templates/ipsec/swanctl/remote_access.tmpl | 9 |
2 files changed, 20 insertions, 3 deletions
diff --git a/data/templates/ipsec/swanctl.conf.tmpl b/data/templates/ipsec/swanctl.conf.tmpl index 15c035688..03f1e9942 100644 --- a/data/templates/ipsec/swanctl.conf.tmpl +++ b/data/templates/ipsec/swanctl.conf.tmpl @@ -21,6 +21,20 @@ connections { {% endif %} } +pools { +{% if remote_access is defined %} +{% for ra, ra_conf in remote_access.items() if remote_access is defined %} + ra-{{ ra }} { + addrs = {{ ra_conf.pool.prefix }} + dns = {{ ra_conf.pool.dns_server | join(",") }} +{% if ra_conf.pool.exclude is defined %} + split_exclude = {{ ra_conf.pool.exclude | join(",") }} +{% endif %} + } +{% endfor %} +{% endif %} +} + secrets { {% if profile is defined %} {% for name, profile_conf in profile.items() if profile_conf.disable is not defined and profile_conf.bind is defined and profile_conf.bind.tunnel is defined %} diff --git a/data/templates/ipsec/swanctl/remote_access.tmpl b/data/templates/ipsec/swanctl/remote_access.tmpl index 89f6e343e..004aace2e 100644 --- a/data/templates/ipsec/swanctl/remote_access.tmpl +++ b/data/templates/ipsec/swanctl/remote_access.tmpl @@ -4,12 +4,13 @@ {% set esp = esp_group[rw_conf.esp_group] %} ra-{{ name }} { remote_addrs = %any - local_addrs = %any + local_addrs = {{ rw_conf.local_address if rw_conf.local_address is defined else '%any' }} proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }} version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }} send_certreq = no rekey_time = {{ ike.lifetime }}s keyingtries = 0 + pools = ra-{{ name }} local { auth = pubkey {% if rw_conf.authentication is defined and rw_conf.authentication.id is defined and rw_conf.authentication.use_x509_id is not defined %} @@ -21,7 +22,6 @@ } remote { auth = eap-mschapv2 - id = %any eap_id = %any } children { @@ -29,8 +29,11 @@ esp_proposals = {{ esp | get_esp_ike_cipher | join(',') }} rekey_time = {{ esp.lifetime }}s rand_time = 540s - local_ts = 0.0.0.0/0 dpd_action = clear +{% set local_prefix = rw_conf.local_network.prefix if rw_conf.local_network is defined and rw_conf.local_network.prefix is defined else ['0.0.0.0/0', '::/0'] %} +{% set local_port = rw_conf.local_network.port if rw_conf.local_network is defined and rw_conf.local_network.port is defined else '' %} +{% set local_suffix = '[%any/{1}]'.format(local_port) if local_port else '' %} + local_ts = {{ local_prefix | join(local_suffix + ",") }}{{ local_suffix }} } } } |