diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-11-28 17:52:59 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2025-12-04 18:03:54 +0300 |
| commit | 2dc91c0a96c3d3212387be02b80c58fce7c68bd8 (patch) | |
| tree | 43adbb21f1a33844e220fa75b290e88b0e0a2241 /data | |
| parent | f4d46db92f9d95c2264c219304172b7b45094bb3 (diff) | |
| download | vyos-1x-2dc91c0a96c3d3212387be02b80c58fce7c68bd8.tar.gz vyos-1x-2dc91c0a96c3d3212387be02b80c58fce7c68bd8.zip | |
ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap`
The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ipsec/swanctl/peer.j2 | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index 518402c53..15b5f5956 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -27,7 +27,7 @@ reauth_time = 0 {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} keyingtries = 0 -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} keyingtries = 1 {% endif %} {% if peer_conf.force_udp_encapsulation is vyos_defined %} @@ -96,7 +96,7 @@ start_action = none {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} start_action = start -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} start_action = trap {% elif peer_conf.connection_type is vyos_defined('none') %} start_action = none @@ -160,7 +160,7 @@ start_action = none {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} start_action = start -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} start_action = trap {% elif peer_conf.connection_type is vyos_defined('none') %} start_action = none |