diff options
| author | Daniil Baturin <daniil@vyos.io> | 2026-10-13 13:09:51 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-10-13 13:09:51 +0100 |
| commit | c0088c622582421ec039f82e03b9bec33e1e3ec4 (patch) | |
| tree | d87e948cf7f499cfdffd16a31f21c5d2dd9c00b3 /docs/configuration/vpn/ipsec | |
| parent | bde9f39953e617214ea6d4462ac76ed5a859c042 (diff) | |
| download | vyos-documentation-docs/t8887-phase1-batch1.tar.gz vyos-documentation-docs/t8887-phase1-batch1.zip | |
Apply suggestions from Liydmyladocs/t8887-phase1-batch1
Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>
Diffstat (limited to 'docs/configuration/vpn/ipsec')
| -rw-r--r-- | docs/configuration/vpn/ipsec/ipsec_general.md | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md index 551718ca..13673836 100644 --- a/docs/configuration/vpn/ipsec/ipsec_general.md +++ b/docs/configuration/vpn/ipsec/ipsec_general.md @@ -153,8 +153,8 @@ configured and required. The in use will show yes ```{cfgcmd} set vpn ipsec site-to-site peer \<name\> childless \<allow | prefer | force | never\> -Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established -without a Child SA). This option applies to IKEv2 only: +**Control childless IKEv2 SA initiation ({rfc}`6023` — an IKE SA established +without a Child SA).** - `allow`: accept childless IKE SA in responder mode; create a regular IKE SA in initiator mode. @@ -163,7 +163,9 @@ without a Child SA). This option applies to IKEv2 only: - `force`: require the use of childless IKE SA in both responder and initiator modes. - `never`: disable support for childless IKE SA when acting as a responder. -``` + +Childless IKE SAs require the connection's `ike-group` to use +`key-exchange ikev2`. Otherwise, the commit fails. ```{cfgcmd} set vpn ipsec remote-access connection \<name\> childless \<allow | prefer | force | never\> |