blob: 0ce703f20e3a280c01efa8a39df6e59a965702d5 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
# Created by VyOS - manual changes will be overwritten
{% if profile is defined %}
connections {
{% for name, profile_conf in profile.items() if "bind" in profile_conf and "tunnel" in profile_conf.bind %}
{% set dmvpn_ike = ike_group[profile_conf.ike_group] %}
{% set dmvpn_esp = esp_group[profile_conf.esp_group] %}
{% for interface in profile_conf.bind.tunnel %}
dmvpn-{{ name }}-{{ interface }} {
proposals = {{ ciphers.ike[profile_conf.ike_group][:-1] }}
version = {{ dmvpn_ike.key_exchange[4:] if "key_exchange" in dmvpn_ike else "0" }}
rekey_time = {{ dmvpn_ike.lifetime if 'lifetime' in dmvpn_ike else '28800' }}s
keyingtries = 0
{% if profile_conf.authentication.mode == 'pre-shared-secret' %}
local {
auth = psk
}
remote {
auth = psk
}
{% endif %}
children {
dmvpn {
esp_proposals = {{ ciphers.esp[profile_conf.esp_group][:-1] }}
rekey_time = {{ dmvpn_esp.lifetime if 'lifetime' in dmvpn_esp else '3600' }}s
rand_time = 540s
local_ts = dynamic[gre]
remote_ts = dynamic[gre]
mode = {{ dmvpn_esp.mode if "mode" in dmvpn_esp else "transport" }}
{% if 'dead_peer_detection' in dmvpn_ike and 'action' in dmvpn_ike.dead_peer_detection %}
dpd_action = {{ dmvpn_ike.dead_peer_detection.action }}
{% endif %}
{% if 'compression' in dmvpn_esp and dmvpn_esp['compression'] == 'enable' %}
ipcomp = yes
{% endif %}
}
}
}
{% endfor %}
{% endfor %}
}
secrets {
{% for name, profile_conf in profile.items() if "bind" in profile_conf and "tunnel" in profile_conf.bind %}
{% if profile_conf.authentication.mode == 'pre-shared-secret' %}
{% for interface in profile_conf.bind.tunnel %}
ike-dmvpn-{{ interface }} {
secret = {{ profile_conf.authentication.pre_shared_secret }}
}
{% endfor %}
{% endif %}
{% endfor %}
}
{% endif %}
|
