diff options
| author | Christian Breunig <christian@breunig.cc> | 2024-08-02 14:42:59 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2024-08-02 14:42:59 +0200 |
| commit | ede841f31425c3fe2f1042e56d4bf3407b8734ae (patch) | |
| tree | 2627dd20be775a22c8af6b72e0218595711ecebd /data | |
| parent | 5e770b631d4ec3b0fb80e7031284c5ee60498252 (diff) | |
| parent | ca12e0bc07ea31d1a6515c0352ae732cfc3674be (diff) | |
| download | vyos-1x-ede841f31425c3fe2f1042e56d4bf3407b8734ae.tar.gz vyos-1x-ede841f31425c3fe2f1042e56d4bf3407b8734ae.zip | |
Merge pull request #3921 from vyos/mergify/bp/sagitta/pr-3903
T6617: T6618: vpn ipsec remote-access: fix profile generators (backport #3903)
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ipsec/ios_profile.j2 | 9 | ||||
| -rw-r--r-- | data/templates/ipsec/windows_profile.j2 | 2 |
2 files changed, 9 insertions, 2 deletions
diff --git a/data/templates/ipsec/ios_profile.j2 b/data/templates/ipsec/ios_profile.j2 index 935acbf8e..966fad433 100644 --- a/data/templates/ipsec/ios_profile.j2 +++ b/data/templates/ipsec/ios_profile.j2 @@ -55,9 +55,11 @@ <!-- The server is authenticated using a certificate --> <key>AuthenticationMethod</key> <string>Certificate</string> +{% if authentication.client_mode.startswith("eap") %} <!-- The client uses EAP to authenticate --> <key>ExtendedAuthEnabled</key> <integer>1</integer> +{% endif %} <!-- The next two dictionaries are optional (as are the keys in them), but it is recommended to specify them as the default is to use 3DES. IMPORTANT: Because only one proposal is sent (even if nothing is configured here) it must match the server configuration --> <key>IKESecurityAssociationParameters</key> @@ -78,9 +80,14 @@ <string>{{ esp_encryption.encryption }}</string> <key>IntegrityAlgorithm</key> <string>{{ esp_encryption.hash }}</string> +{% if esp_encryption.pfs is vyos_defined %} <key>DiffieHellmanGroup</key> - <integer>{{ ike_encryption.dh_group }}</integer> + <integer>{{ esp_encryption.pfs }}</integer> +{% endif %} </dict> + <!-- Controls whether the client offers Perfect Forward Secrecy (PFS). This should be set to match the server. --> + <key>EnablePFS</key> + <integer>{{ '1' if esp_encryption.pfs is vyos_defined else '0' }}</integer> </dict> </dict> {% if ca_certificates is vyos_defined %} diff --git a/data/templates/ipsec/windows_profile.j2 b/data/templates/ipsec/windows_profile.j2 index 8c26944be..b5042f987 100644 --- a/data/templates/ipsec/windows_profile.j2 +++ b/data/templates/ipsec/windows_profile.j2 @@ -1,4 +1,4 @@ Remove-VpnConnection -Name "{{ vpn_name }}" -Force -PassThru Add-VpnConnection -Name "{{ vpn_name }}" -ServerAddress "{{ remote }}" -TunnelType "Ikev2" -Set-VpnConnectionIPsecConfiguration -ConnectionName "{{ vpn_name }}" -AuthenticationTransformConstants {{ ike_encryption.encryption }} -CipherTransformConstants {{ ike_encryption.encryption }} -EncryptionMethod {{ esp_encryption.encryption }} -IntegrityCheckMethod {{ esp_encryption.hash }} -PfsGroup None -DHGroup "Group{{ ike_encryption.dh_group }}" -PassThru -Force +Set-VpnConnectionIPsecConfiguration -ConnectionName "{{ vpn_name }}" -AuthenticationTransformConstants {{ ike_encryption.encryption }} -CipherTransformConstants {{ ike_encryption.encryption }} -EncryptionMethod {{ esp_encryption.encryption }} -IntegrityCheckMethod {{ esp_encryption.hash }} -PfsGroup {{ esp_encryption.pfs }} -DHGroup {{ ike_encryption.dh_group }} -PassThru -Force |