{% macro conn(name, profile_conf, ike_group, esp_group) %}
{#   peer needs to reference the global IKE configuration for certain values #}
{%   set ike = ike_group[profile_conf.ike_group] %}
{%   set esp = esp_group[profile_conf.esp_group] %}
{%   if profile_conf.bind is defined and profile_conf.bind.tunnel is defined %}
{%     for interface in profile_conf.bind.tunnel %}
    dmvpn-{{ name }}-{{ interface }} {
        proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher | join(',') }}
        version = {{ ike.key_exchange[4:] if ike is defined and ike.key_exchange is defined else "0" }}
        rekey_time = {{ ike.lifetime if ike.lifetime is defined else '28800' }}s
        keyingtries = 0
{%       if profile_conf.authentication is defined and profile_conf.authentication.mode is defined and profile_conf.authentication.mode == 'pre-shared-secret' %}
        local {
            auth = psk
        }
        remote {
            auth = psk
        }
{%       endif %}
        children {
            dmvpn {
                esp_proposals = {{ esp | get_esp_ike_cipher | join(',')  }}
                rekey_time = {{ esp.lifetime if esp.lifetime is defined else '3600' }}s
                rand_time = 540s
                local_ts = dynamic[gre]
                remote_ts = dynamic[gre]
                mode = {{ esp.mode if esp.mode is defined else 'transport' }}
{%       if ike.dead_peer_detection is defined and ike.dead_peer_detection.action is defined %}
                dpd_action = {{ ike.dead_peer_detection.action }}
{%       endif %}
{%       if esp.compression is defined and esp.compression == 'enable' %}
                ipcomp = yes
{%       endif %}
            }
        }
    }
{%     endfor %}
{%   endif %}
{% endmacro %}