diff options
| author | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-09-15 12:10:16 +0300 |
|---|---|---|
| committer | Oleksandr Kuchmystyi <o.kuchmystyi@vyos.io> | 2026-09-16 11:22:40 +0300 |
| commit | d1cc3ed65eb1f00409d0b91fc8149431fb614e89 (patch) | |
| tree | 4e2f2fe9e22339d18ceb34bd949991bc24634c06 /interface-definitions/include | |
| parent | 28207a3068fd23d73c93cda806ed3757f9651a5f (diff) | |
| download | vyos-1x-d1cc3ed65eb1f00409d0b91fc8149431fb614e89.tar.gz vyos-1x-d1cc3ed65eb1f00409d0b91fc8149431fb614e89.zip | |
ipsec: T8952: Allow per-peer strongSwan `unique` override for site-to-site peers
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
Diffstat (limited to 'interface-definitions/include')
| -rw-r--r-- | interface-definitions/include/vpn-ipsec-unique.xml.i | 25 |
1 files changed, 25 insertions, 0 deletions
diff --git a/interface-definitions/include/vpn-ipsec-unique.xml.i b/interface-definitions/include/vpn-ipsec-unique.xml.i new file mode 100644 index 000000000..bff64fee3 --- /dev/null +++ b/interface-definitions/include/vpn-ipsec-unique.xml.i @@ -0,0 +1,25 @@ +<!-- include start from vpn-ipsec-unique.xml.i --> +<leafNode name="unique"> + <properties> + <help>Connection uniqueness enforcement policy</help> + <completionHelp> + <list>never keep replace</list> + </completionHelp> + <valueHelp> + <format>never</format> + <description>Never enforce connection uniqueness</description> + </valueHelp> + <valueHelp> + <format>keep</format> + <description>Reject new connection attempts if the same peer has an active connection</description> + </valueHelp> + <valueHelp> + <format>replace</format> + <description>Delete existing connections when a new connection is established for the same peer</description> + </valueHelp> + <constraint> + <regex>(never|keep|replace)</regex> + </constraint> + </properties> +</leafNode> +<!-- include end --> |