From 2dc91c0a96c3d3212387be02b80c58fce7c68bd8 Mon Sep 17 00:00:00 2001 From: Oleksandr Kuchmystyi Date: Fri, 28 Nov 2025 17:52:59 +0300 Subject: ipsec: T7594: Rename `respond` connection-type in IPSec peer settings to `trap` The previous 'connection-type respond' option in IPsec site-to-site peers was misleading - instead of passively waiting for peer initiation, it would initiate negotiation when matching traffic appeared, potentially causing SA duplication and renegotiation loops. --- data/templates/ipsec/swanctl/peer.j2 | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'data') diff --git a/data/templates/ipsec/swanctl/peer.j2 b/data/templates/ipsec/swanctl/peer.j2 index 518402c53..15b5f5956 100644 --- a/data/templates/ipsec/swanctl/peer.j2 +++ b/data/templates/ipsec/swanctl/peer.j2 @@ -27,7 +27,7 @@ reauth_time = 0 {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} keyingtries = 0 -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} keyingtries = 1 {% endif %} {% if peer_conf.force_udp_encapsulation is vyos_defined %} @@ -96,7 +96,7 @@ start_action = none {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} start_action = start -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} start_action = trap {% elif peer_conf.connection_type is vyos_defined('none') %} start_action = none @@ -160,7 +160,7 @@ start_action = none {% elif peer_conf.connection_type is not vyos_defined or peer_conf.connection_type is vyos_defined('initiate') %} start_action = start -{% elif peer_conf.connection_type is vyos_defined('respond') %} +{% elif peer_conf.connection_type is vyos_defined('trap') %} start_action = trap {% elif peer_conf.connection_type is vyos_defined('none') %} start_action = none -- cgit v1.2.3