Merge pull request #2333 from ruben-herold/docs-vpn-missing-options

vpn: document disable-mobike, disable-uniqreqids, eap-id and L2TP IPs…

3 files changed, 64 insertions, 0 deletions

diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md
index 13673836..6fa601b9 100644
--- a/docs/configuration/vpn/ipsec/ipsec_general.md
+++ b/docs/configuration/vpn/ipsec/ipsec_general.md
@@ -192,6 +192,14 @@ VyOS IKE group has the next options:
    required IKE/IPsec SAs.
  * **start** - Tries to immediately re-create the CHILD_SA.
 
+.. cfgcmd:: set vpn ipsec ike-group <name> disable-mobike
+
+  Disable MOBIKE (IKEv2 Mobility and Multihoming, :rfc:`4555`) for
+  connections that use this IKE group. MOBIKE is enabled by default and
+  allows a peer to move an IKE SA to a new IP address without
+  re-establishing the tunnel. Disable it if the remote peer does not
+  handle MOBIKE correctly. It has no effect on IKEv1.
+
 .. cfgcmd:: set vpn ipsec ike-group <name> ikev2-reauth
 
   Whether rekeying of an IKE_SA should also reauthenticate
@@ -337,6 +345,19 @@ VyOS ESP group has the next options:
 Global IPsec Settings
 =====================
 
+.. cfgcmd:: set vpn ipsec disable-uniqreqids
+
+  Do not enforce unique IKE identities. By default a new IKE_SA replaces an
+  existing one that uses the same remote identity, and the existing one is
+  closed. With this option set, several IKE_SAs with the same identity can
+  exist at the same time, for example when multiple clients or sites
+  authenticate with the same identity.
+
+  The option applies to site-to-site peers, profiles and L2TP/IPsec. A
+  ``unique`` setting on an individual site-to-site peer takes precedence.
+  It is not used for ``remote-access`` connections, which use their own
+  ``unique`` setting.
+
 .. cfgcmd:: set vpn ipsec interface <name>
 
   Interface name to restrict outbound IPsec policies. There is a possibility
diff --git a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md
index 6931e00b..7a4440e5 100644
--- a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md
+++ b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md
@@ -143,6 +143,17 @@ requested.
 set vpn ipsec remote-access connection rw authentication always-send-cert
 ```
 
+With the `eap-tls`, `eap-mschapv2` and `eap-radius` client modes the server
+asks the client for its EAP identity. By default any identity is accepted.
+To accept only a specific identity, set it explicitly:
+
+```{cfgcmd} set vpn ipsec remote-access connection \<name\> authentication eap-id \<id | any\>
+
+EAP identity the client must present. The identity is a string of up to 64
+ASCII characters, the default `any` accepts every identity. The option has no
+effect with the `x509` client mode.
+```
+
 
 ## Client Configuration
 
diff --git a/docs/configuration/vpn/l2tp.md b/docs/configuration/vpn/l2tp.md
index 3b131b98..7746666f 100644
--- a/docs/configuration/vpn/l2tp.md
+++ b/docs/configuration/vpn/l2tp.md
@@ -82,6 +82,38 @@ Set mode for IPsec authentication between VyOS and L2TP clients.
 Set predefined shared secret phrase.
 ```
 
+
+```{cfgcmd} set vpn l2tp remote-access ipsec-settings ike-group \<name\>
+
+Use the settings of an existing `vpn ipsec ike-group` for the IKE
+negotiation, instead of the built-in defaults. The group must exist, the
+commit fails otherwise.
+```
+
+
+```{cfgcmd} set vpn l2tp remote-access ipsec-settings esp-group \<name\>
+
+Use the settings of an existing `vpn ipsec esp-group` for the ESP
+negotiation, instead of the built-in defaults. The group must exist, the
+commit fails otherwise.
+```
+
+
+```{cfgcmd} set vpn l2tp remote-access ipsec-settings ike-lifetime \<seconds\>
+
+IKE lifetime in seconds, from 30 to 86400. The default is 3600 seconds. The
+value is only used when no `ike-group` is configured, otherwise the `lifetime`
+of the IKE group applies.
+```
+
+
+```{cfgcmd} set vpn l2tp remote-access ipsec-settings lifetime \<seconds\>
+
+ESP lifetime in seconds, from 30 to 86400. The default is 3600 seconds. The
+value is only used when no `esp-group` is configured, otherwise the `lifetime`
+of the ESP group applies.
+```
+
 If a local firewall policy is in place on your external interface you will need
 to allow the ports below:
 - UDP port 500 (IKE)