diff options
Diffstat (limited to 'docs/configuration/interfaces')
| -rw-r--r-- | docs/configuration/interfaces/vti.rst | 102 |
1 files changed, 87 insertions, 15 deletions
diff --git a/docs/configuration/interfaces/vti.rst b/docs/configuration/interfaces/vti.rst index 9c2dc1eb..e45c17d9 100644 --- a/docs/configuration/interfaces/vti.rst +++ b/docs/configuration/interfaces/vti.rst @@ -1,20 +1,92 @@ .. _vti-interface: ############################## -VTI - Virtual Tunnel Interface +VTI (virtual tunnel interface) ############################## -.. TODO:: Convert raw command blocks in this file to cfgcmd/opcmd - directives for command coverage tracking. +:abbr:`VTIs (virtual tunnel interfaces)` let you create secure, encrypted +tunnels between private networks or hosts across public infrastructure, such as +the Internet. They operate alongside an underlying IPsec tunnel, which handles +encapsulation and encryption, while VTIs function exclusively as routing +interfaces. -Set Virtual Tunnel Interface +************* +Configuration +************* + +Common interface configuration +============================== + +.. cmdinclude:: /_include/interface-address.txt + :var0: vti + :var1: vti0 + +.. cmdinclude:: /_include/interface-description.txt + :var0: vti + :var1: vti0 + +.. cmdinclude:: /_include/interface-disable.txt + :var0: vti + :var1: vti0 + +.. cmdinclude:: /_include/interface-ip.txt + :var0: vti + :var1: vti0 + +.. cmdinclude:: /_include/interface-ipv6.txt + :var0: vti + :var1: vti0 + +.. cmdinclude:: /_include/interface-mtu.txt + :var0: vti + :var1: vti0 + +.. cfgcmd:: set interfaces vti <interface> mirror egress <monitor-interface> + + Configure mirroring of outgoing traffic from the specified VTI to the + designated monitor interface. + +.. cfgcmd:: set interfaces vti <interface> mirror ingress <monitor-interface> + + Configure mirroring of incoming traffic from the specified VTI to the + designated monitor interface. + +.. cfgcmd:: set interfaces vti <interface> redirect <interface> + + Enable redirection of incoming packets to the specified interface. + +.. cmdinclude:: /_include/interface-vrf.txt + :var0: vti + :var1: vti0 + +********* +Operation +********* + +.. opcmd:: show interfaces vti <vtiX> + + Show the operational status and traffic statistics for the specified VTI. + +.. opcmd:: show interfaces vti <vtiX> brief + + Show a brief operational status summary for the specified VTI. + + +******* +Example +******* + +**Configure a VTI** + +Assign IPv4 and IPv6 addresses to the VTI, along with a brief description: .. code-block:: none set interfaces vti vti0 address 192.168.2.249/30 set interfaces vti vti0 address 2001:db8:2::249/64 + set interfaces vti vti0 description "Description" -Results in: +Resulting configuration: .. code-block:: none @@ -25,19 +97,19 @@ Results in: description "Description" } -.. warning:: When using site-to-site IPsec with VTI interfaces, - be sure to disable route autoinstall +.. warning:: When configuring site-to-site IPsec with VTIs, ensure that route + autoinstall is disabled. .. code-block:: none set vpn ipsec options disable-route-autoinstall -More details about the IPsec and VTI issue and option disable-route-autoinstall -https://blog.vyos.io/vyos-1-dot-2-0-development-news-in-july +For more information about the IPsec and VTI issue, as well as the +``disable-route-autoinstall`` option, see: +https://blog.vyos.io/vyos-1-dot-2-0-development-news-in-july. -The root cause of the problem is that for VTI tunnels to work, their traffic -selectors have to be set to 0.0.0.0/0 for traffic to match the tunnel, even -though actual routing decision is made according to netfilter marks. Unless -route insertion is disabled entirely, StrongSWAN thus mistakenly inserts a -default route through the VTI peer address, which makes all traffic routed -to nowhere.
\ No newline at end of file +The root cause of the problem is that VTI tunnels require their traffic +selectors to be set to ``0.0.0.0/0`` for traffic to match the tunnel, even +though routing decisions are based on netfilter marks. Unless route insertion +is explicitly disabled, strongSWAN incorrectly inserts a default route through +the VTI peer address, causing all traffic to be misrouted. |