diff options
| author | Christian Poessinger <christian@poessinger.com> | 2021-06-28 22:58:24 +0200 |
|---|---|---|
| committer | Christian Poessinger <christian@poessinger.com> | 2021-06-28 22:58:24 +0200 |
| commit | 0751065ffa2161bedd040197dd51ad6ece5ab19b (patch) | |
| tree | 7fcbdbe7dbc35e1f2b71b383485fd3017ac83fb7 /src/conf_mode/policy.py | |
| parent | 5a5c0cd2e6f5d6c459a7f0e2da777834fb4362b2 (diff) | |
| download | vyos-1x-0751065ffa2161bedd040197dd51ad6ece5ab19b.tar.gz vyos-1x-0751065ffa2161bedd040197dd51ad6ece5ab19b.zip | |
ipsec: T1441: switch from vti to xfrm interfaces
XFRM interfaces are similar to VTI devices in their basic functionality but
offer several advantages:
* No tunnel endpoint addresses have to be configured on the interfaces.
Compared to VTIs, which are layer 3 tunnel devices with mandatory endpoints,
this resolves issues with wildcard addresses (only one VTI with wildcard
endpoints is supported), avoids a 1:1 mapping between SAs and interfaces, and
easily allows SAs with multiple peers to share the same interface.
* Because there are no endpoint addresses, IPv4 and IPv6 SAs are supported on
the same interface (VTI devices only support one address family).
* IPsec modes other than tunnel are supported (VTI devices only support
tunnel mode).
* No awkward configuration via GRE keys and XFRM marks. Instead, a new identifier
(XFRM interface ID) links policies and SAs with XFRM interfaces.
Diffstat (limited to 'src/conf_mode/policy.py')
0 files changed, 0 insertions, 0 deletions