diff options
Diffstat (limited to 'data/templates/ipsec/swanctl/profile.j2')
| -rw-r--r-- | data/templates/ipsec/swanctl/profile.j2 | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/profile.j2 b/data/templates/ipsec/swanctl/profile.j2 new file mode 100644 index 000000000..d4f417378 --- /dev/null +++ b/data/templates/ipsec/swanctl/profile.j2 @@ -0,0 +1,39 @@ +{% macro conn(name, profile_conf, ike_group, esp_group) %} +{# peer needs to reference the global IKE configuration for certain values #} +{% set ike = ike_group[profile_conf.ike_group] %} +{% set esp = esp_group[profile_conf.esp_group] %} +{% if profile_conf.bind.tunnel is vyos_defined %} +{% for interface in profile_conf.bind.tunnel %} + dmvpn-{{ name }}-{{ interface }} { + proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }} + version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }} + rekey_time = {{ ike.lifetime }}s + keyingtries = 0 +{% if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %} + local { + auth = psk + } + remote { + auth = psk + } +{% endif %} + children { + dmvpn { + esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }} + rekey_time = {{ esp.lifetime }}s + rand_time = 540s + local_ts = dynamic[gre] + remote_ts = dynamic[gre] + mode = {{ esp.mode }} +{% if ike.dead_peer_detection.action is vyos_defined %} + dpd_action = {{ ike.dead_peer_detection.action }} +{% endif %} +{% if esp.compression is vyos_defined('enable') %} + ipcomp = yes +{% endif %} + } + } + } +{% endfor %} +{% endif %} +{% endmacro %} |