| Age | Commit message (Collapse) | Author |
|---|
|
|
|
Set default passtrough list to None to prevent unexpected policy
for peers with not overplapped local and remote prefixes
|
|
|
|
close-action parameter is missing in the swanctl.conf file
|
|
ipsec: T1856: Ability to set SA life bytes and packets
|
|
set vpn ipsec site-to-site peer 192.0.2.14 connection-type none
|
|
set vpn ipsec esp-group grp-ESP life-bytes '100000'
set vpn ipsec esp-group grp-ESP life-packets '2000000'
|
|
Ability to set Cisco FlexVPN vendor ID payload:
charon.cisco_flexvpn
charon.install_virtual_ip_on
swanctl.connections.<conn>.vips = x.x.x.x, z.z.z.z
set vpn ipsec options flexvpn
set vpn ipsec options virtual-ip
set vpn ipsec options interface tunX
set vpn ipsec site-to-site peer x.x.x.x virtual-address x.x.x.x
|
|
Add priority for policy based IPSec VPN tunnels
If 2 tunnels have the same pair of local and remote traffic
selectors (prefixes) it allows to set more preforable install
policy from required peer
The lowest priority is more preforable
|
|
Peer name must not contain dots and colons, otherwise
swanct can't generate correct configuration for swanctl.conf
This is used in connection names and child SA names
Add filter 'dot_colon_to_dash' which replace dots and colons
|
|
|
|
The key defaults to 0 and will match any policies which similarly do not have
a lookup key configuration. This means that a vti0 named interface will pull in
all traffic and others will stop working. Thus we simply shift the key by one
to also support a vti0 interface.
|
|
Manually set peer id and use-x509-id are mutually exclusive!
|
|
Restore "default" behavior from ipsec.conf
|
|
|
|
Commit 7a873eb6 ("ipsec: T3764: bugfix missing IKE and ESP lifetime values")
re-added the lost in translation IKE/ESP rekey values. But it did not specify
the unit, which is s(econd).
|
|
During the migration the IKE and ESP key/re-key lifetime settings got lost in
translation. This is now fixed and the values/defaults correspond to VyOS 1.3.
|
|
|
|
|
|
|
|
|
|
VyOS has a known to work mechanism in supplying CLI default values into the
Python configuration scripts. This commit removes hardcoded default values from
the Jinja2 template and places them into the appropriate XML definitions.
The big advantage is that the default value itself and the corresponding help
string are located in the exact same file.
|
|
Commit 2d79a500 ("ipsec: T2816: add Jinja2 converter for ESP/IKE groups to
string") added a Jinja2 helper function which can be used to transform VyOS CLI
ESP and IKE key proposals into a strongSwan compatible string cipher.
This commit changes the IPSec implementation to make use of this new Jinja2
filter fubction/Python helper. This is required base work for better automated
tests (smoketests) but also for an IKEv2 road-warrior setup.
|
|
* use indent = 2
* prefer 'if foo.bar is defined' over 'if "bar" in foo'
|
|
* 'pki_ipsec' of https://github.com/sarthurdev/vyos-1x:
pki: ipsec: T3642: Update migration script to account for file permission issues
pki: ipsec: T3642: Migrate IPSec to use PKI configuration
pki: T3642: New PKI config and management
|
|
|
|
XFRM interfaces are similar to VTI devices in their basic functionality but
offer several advantages:
* No tunnel endpoint addresses have to be configured on the interfaces.
Compared to VTIs, which are layer 3 tunnel devices with mandatory endpoints,
this resolves issues with wildcard addresses (only one VTI with wildcard
endpoints is supported), avoids a 1:1 mapping between SAs and interfaces, and
easily allows SAs with multiple peers to share the same interface.
* Because there are no endpoint addresses, IPv4 and IPv6 SAs are supported on
the same interface (VTI devices only support one address family).
* IPsec modes other than tunnel are supported (VTI devices only support
tunnel mode).
* No awkward configuration via GRE keys and XFRM marks. Instead, a new identifier
(XFRM interface ID) links policies and SAs with XFRM interfaces.
|
|
selectors, and selectors with VTI.
|
