diff options
| author | Viacheslav Hletenko <v.gletenko@vyos.io> | 2025-04-12 08:45:16 +0000 |
|---|---|---|
| committer | Viacheslav <v.gletenko@vyos.io> | 2025-04-17 09:45:46 +0000 |
| commit | 41ba7fc5c7edbaca6ff149818aa5689b3ac3c097 (patch) | |
| tree | 7ef04ef4fa4632bdae0555f902734eddd1f08e37 /data | |
| parent | d1e8dbd33ad84999ea4feea075d723068628ab1d (diff) | |
| download | vyos-1x-41ba7fc5c7edbaca6ff149818aa5689b3ac3c097.tar.gz vyos-1x-41ba7fc5c7edbaca6ff149818aa5689b3ac3c097.zip | |
T7343: IPsec add traffic-selector handling for VTI interfaces
Allow to set traffic-selector for VTI interfaces
We can set several local and remote IPv4 and IPv6 prefixes
```
set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix 0.0.0.0/0
set vpn ipsec site-to-site peer P1 vti traffic-selector local prefix :/0
set vpn ipsec site-to-site peer P1 vti traffic-selector remote prefix 192.0.2.0/24
```
Diffstat (limited to 'data')
| -rw-r--r-- | data/templates/ipsec/swanctl/peer.j2 | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index 3a9af2c94..cf0865c88 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -68,8 +68,19 @@ rekey_packets = 0 rekey_time = 0s {% endif %} - local_ts = 0.0.0.0/0,::/0 - remote_ts = 0.0.0.0/0,::/0 +{# set default traffic-selectors #} +{% set local_ts = '0.0.0.0/0,::/0' %} +{% set remote_ts = '0.0.0.0/0,::/0' %} +{% if peer_conf.vti.traffic_selector is vyos_defined %} +{% if peer_conf.vti.traffic_selector.local is vyos_defined and peer_conf.vti.traffic_selector.local.prefix is vyos_defined %} +{% set local_ts = peer_conf.vti.traffic_selector.local.prefix | join(',') %} +{% endif %} +{% if peer_conf.vti.traffic_selector.remote is vyos_defined and peer_conf.vti.traffic_selector.remote.prefix is vyos_defined %} +{% set remote_ts = peer_conf.vti.traffic_selector.remote.prefix | join(',') %} +{% endif %} +{% endif %} + local_ts = {{ local_ts }} + remote_ts = {{ remote_ts }} updown = "/etc/ipsec.d/vti-up-down {{ peer_conf.vti.bind }}" {# The key defaults to 0 and will match any policies which similarly do not have a lookup key configuration. #} {# Thus we simply shift the key by one to also support a vti0 interface #} |