1 files changed, 22 insertions, 2 deletions
diff --git a/python/vyos/template.py b/python/vyos/template.py
index 1233710f2..8d861096b 100755
--- a/python/vyos/template.py
+++ b/python/vyos/template.py
@@ -482,8 +482,7 @@ def get_first_ike_dh_group(ike_group):
                 return 'dh-group' + proposal['dh_group']
     return 'dh-group2' # Fallback on dh-group2
 
-@register_filter('get_esp_ike_cipher')
-def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
+def _get_esp_ike_cipher(group_config, ike_group=None, esn=True):
     """Render strongSwan proposal strings.
 
     esn=True  : ESP/CHILD_SA proposals, where ESN transforms are meaningful
@@ -492,6 +491,10 @@ def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
                 IKE_SA proposal. Emitting it there breaks interoperability
                 with implementations that reject the malformed payload
                 without replying at all (observed with Cisco FTD, T9254).
+
+    Not registered as a filter directly: callers must go through
+    get_esp_cipher() or get_ike_cipher() so esn can't be left at its
+    default where an IKE cipher is needed.
     """
     pfs_lut = {
         'dh-group1'  : 'modp768',
@@ -555,6 +558,23 @@ def get_esp_ike_cipher(group_config, ike_group=None, esn=True):
             ciphers.append(tmp)
     return ciphers
 
+
+@register_filter('get_esp_cipher')
+def get_esp_cipher(group_config, ike_group=None):
+    """ESP/CHILD_SA proposals, where ESN transforms are meaningful."""
+    return _get_esp_ike_cipher(group_config, ike_group=ike_group, esn=True)
+
+
+@register_filter('get_ike_cipher')
+def get_ike_cipher(group_config):
+    """IKE_SA proposals. ESN is a CHILD_SA transform (RFC 7296 section
+    3.3.2, Transform Type 5) and has no meaning in an IKE_SA proposal.
+    Emitting it there breaks interoperability with implementations that
+    reject the malformed payload without replying at all (observed with
+    Cisco FTD, T9254).
+    """
+    return _get_esp_ike_cipher(group_config, esn=False)
+
 @register_filter('get_uuid')
 def get_uuid(seed):
     """ Get interface IP addresses"""