ipsec: T7594: Change connection-type to trap for all peers and configurations (#1719)

The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.

3 files changed, 4 insertions, 4 deletions

diff --git a/docs/configexamples/azure-vpn-bgp.rst b/docs/configexamples/azure-vpn-bgp.rst
index f272aafd..03d637d8 100644
--- a/docs/configexamples/azure-vpn-bgp.rst
+++ b/docs/configexamples/azure-vpn-bgp.rst
@@ -105,7 +105,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate'
   set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
   set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
   set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
diff --git a/docs/configexamples/azure-vpn-dual-bgp.rst b/docs/configexamples/azure-vpn-dual-bgp.rst
index d019092c..d37aa85c 100644
--- a/docs/configexamples/azure-vpn-dual-bgp.rst
+++ b/docs/configexamples/azure-vpn-dual-bgp.rst
@@ -110,7 +110,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer azure-primary connection-type 'respond'
+  set vpn ipsec site-to-site peer azure-primary connection-type 'initiate'
   set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
   set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
   set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
@@ -122,7 +122,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
-  set vpn ipsec site-to-site peer azure-secondary connection-type 'respond'
+  set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate'
   set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
   set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
   set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'
diff --git a/docs/configexamples/policy-based-ipsec-and-firewall.rst b/docs/configexamples/policy-based-ipsec-and-firewall.rst
index 8dc07de6..504a6fd6 100644
--- a/docs/configexamples/policy-based-ipsec-and-firewall.rst
+++ b/docs/configexamples/policy-based-ipsec-and-firewall.rst
@@ -106,7 +106,7 @@ IPSec configuration:
     set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
     set vpn ipsec interface 'eth0'
     set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
-    set vpn ipsec site-to-site peer LEFT connection-type 'respond'
+    set vpn ipsec site-to-site peer LEFT connection-type 'none'
     set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
     set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
     set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'