diff options
| author | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-06-20 09:37:42 +0300 |
|---|---|---|
| committer | Kyrylo Yatsenko <hedrok@gmail.com> | 2026-06-20 09:59:00 +0300 |
| commit | e8611801c7f36d7942ed367c5cf0b0dfd08083d2 (patch) | |
| tree | 763f3bcf6f7a8820083575893891629fd9954f32 /interface-definitions | |
| parent | 6c0fd99099a6251a12bc2287d5ba2ab115cd8015 (diff) | |
| download | vyos-1x-e8611801c7f36d7942ed367c5cf0b0dfd08083d2.tar.gz vyos-1x-e8611801c7f36d7942ed367c5cf0b0dfd08083d2.zip | |
T8097: strongswan: add CLI for ESN
Add CLI commands:
set vpn ipsec ike-group MyIKEGroup proposal 1 esn ESN-VALUE
set vpn ipsec esp-group MyESPGroup proposal 1 esn ESN-VALUE
Where ESN-VALUE can be one of:
* required: only establish connection using ESN
* optional: try using ESN, but if not available, accept non-ESN
* disabled (default): don't use ESN
StrongSwan 6.0.6 doesn't allow connections between proposal with
'-noesn' and without '-esn'/'-noesn'. To make it work as expected, use
two proposals for 'optional' and 'disabled':
* required: PROPOSAL-esn
* optional: PROPOSAL-esn-noesn,PROPOSAL
* disabled: PROPOSAL-noesn,PROPOSAL
Diffstat (limited to 'interface-definitions')
| -rw-r--r-- | interface-definitions/include/vpn-ipsec-esn.xml.i | 26 | ||||
| -rw-r--r-- | interface-definitions/vpn_ipsec.xml.in | 2 |
2 files changed, 28 insertions, 0 deletions
diff --git a/interface-definitions/include/vpn-ipsec-esn.xml.i b/interface-definitions/include/vpn-ipsec-esn.xml.i new file mode 100644 index 000000000..b4faa25d5 --- /dev/null +++ b/interface-definitions/include/vpn-ipsec-esn.xml.i @@ -0,0 +1,26 @@ +<!-- include start from vpn-ipsec-esn.xml.i --> +<leafNode name="esn"> + <properties> + <help>Extended Sequence Number (ESN)</help> + <completionHelp> + <list>optional required disabled</list> + </completionHelp> + <valueHelp> + <format>optional</format> + <description>Prefer ESN, but allow 32-bit sequence numbers</description> + </valueHelp> + <valueHelp> + <format>required</format> + <description>ESN enabled, accept 64-bit sequence numbers only</description> + </valueHelp> + <valueHelp> + <format>disabled</format> + <description>ESN disabled, accept 32-bit sequence numbers only</description> + </valueHelp> + <constraint> + <regex>(optional|required|disabled)</regex> + </constraint> + </properties> + <defaultValue>disabled</defaultValue> +</leafNode> +<!-- include end --> diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in index ee8340a74..5ae9a8d64 100644 --- a/interface-definitions/vpn_ipsec.xml.in +++ b/interface-definitions/vpn_ipsec.xml.in @@ -294,6 +294,7 @@ <children> #include <include/vpn-ipsec-encryption.xml.i> #include <include/vpn-ipsec-hash.xml.i> + #include <include/vpn-ipsec-esn.xml.i> </children> </tagNode> </children> @@ -598,6 +599,7 @@ </leafNode> #include <include/vpn-ipsec-encryption.xml.i> #include <include/vpn-ipsec-hash.xml.i> + #include <include/vpn-ipsec-esn.xml.i> </children> </tagNode> </children> |