diff options
| author | Antonio Quartulli <antonio@mandelbit.com> | 2026-10-01 15:14:40 +0200 |
|---|---|---|
| committer | Antonio Quartulli <antonio@mandelbit.com> | 2026-10-01 15:45:07 +0200 |
| commit | e9248b8dd0f202499149a25c806a034289b7a21e (patch) | |
| tree | 46dfd056eb6e29e584c07043fe2d5cae35662830 /docs | |
| parent | 21ba73b10bbb3b2c08a67c22f06c6da999809450 (diff) | |
| download | vyos-documentation-e9248b8dd0f202499149a25c806a034289b7a21e.tar.gz vyos-documentation-e9248b8dd0f202499149a25c806a034289b7a21e.zip | |
openvpn: T9370: document the chacha20poly1305 data cipher
Add chacha20poly1305 to "encryption data-ciphers" and
"encryption data-ciphers-fallback".
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/configuration/interfaces/openvpn.md | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/docs/configuration/interfaces/openvpn.md b/docs/configuration/interfaces/openvpn.md index 170c585d..6f3f145c 100644 --- a/docs/configuration/interfaces/openvpn.md +++ b/docs/configuration/interfaces/openvpn.md @@ -79,7 +79,7 @@ and should be used only in compatibility scenarios. ``` -```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure a prioritized list of negotiated ciphers for OpenVPN in** ``client`` **or** ``server`` **mode.** @@ -89,13 +89,16 @@ algorithms. It corresponds to OpenVPN’s ``--data-ciphers`` directive and enables cipher negotiation, where both peers automatically agree on a mutually supported cipher during session startup. +`chacha20poly1305` selects ChaCha20-Poly1305, which DCO offloads just like +the AES-GCM ciphers. + :::{note} This option is not compatible with ``site-to-site`` mode. ::: ``` -```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | none \> +```{cfgcmd} set interfaces openvpn \<interface\> encryption data-ciphers-fallback \< 3des | aes128 | aes128gcm | aes192 | aes192gcm | aes256 | aes256gcm | chacha20poly1305 | none \> **Configure the fallback cipher for** ``site-to-site`` **mode.** |