diff options
Diffstat (limited to 'data/templates/ipsec/swanctl/profile.tmpl')
| -rw-r--r-- | data/templates/ipsec/swanctl/profile.tmpl | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/data/templates/ipsec/swanctl/profile.tmpl b/data/templates/ipsec/swanctl/profile.tmpl new file mode 100644 index 000000000..e4b36b99f --- /dev/null +++ b/data/templates/ipsec/swanctl/profile.tmpl @@ -0,0 +1,34 @@ +{% macro conn(name, profile_conf, ike, esp, ciphers) %} +{% for interface in profile_conf.bind.tunnel %} + dmvpn-{{ name }}-{{ interface }} { + proposals = {{ ciphers.ike[profile_conf.ike_group] }} + version = {{ ike.key_exchange[4:] if "key_exchange" in ike else "0" }} + rekey_time = {{ ike.lifetime if 'lifetime' in ike else '28800' }}s + keyingtries = 0 +{% if profile_conf.authentication.mode == 'pre-shared-secret' %} + local { + auth = psk + } + remote { + auth = psk + } +{% endif %} + children { + dmvpn { + esp_proposals = {{ ciphers.esp[profile_conf.esp_group] }} + rekey_time = {{ esp.lifetime if 'lifetime' in esp else '3600' }}s + rand_time = 540s + local_ts = dynamic[gre] + remote_ts = dynamic[gre] + mode = {{ esp.mode if "mode" in esp else "transport" }} +{% if 'dead_peer_detection' in ike and 'action' in ike.dead_peer_detection %} + dpd_action = {{ ike.dead_peer_detection.action }} +{% endif %} +{% if 'compression' in esp and esp['compression'] == 'enable' %} + ipcomp = yes +{% endif %} + } + } + } +{% endfor %} +{% endmacro %} |