From 617a90064248775d01bd2a65050898fce32ab52c Mon Sep 17 00:00:00 2001 From: Giga Murphy Date: Thu, 5 Mar 2026 04:32:24 -0500 Subject: T8136: IPSEC PPK Support (#1733) * T8136: IPSEC PPK Support * Fix styling and capitalization issues. --------- Co-authored-by: Daniil Baturin --- docs/configuration/vpn/ipsec/ipsec_general.rst | 41 ++++++++++++++++++++++++++ 1 file changed, 41 insertions(+) diff --git a/docs/configuration/vpn/ipsec/ipsec_general.rst b/docs/configuration/vpn/ipsec/ipsec_general.rst index 152558ca..873f4f51 100644 --- a/docs/configuration/vpn/ipsec/ipsec_general.rst +++ b/docs/configuration/vpn/ipsec/ipsec_general.rst @@ -108,6 +108,47 @@ In IKEv2, DPD sends messages every configured interval. If one request is not responded, Strongswan execute its retransmission algorithm with its timers. `IKEv2 Retransmission`_ +********************************* +Post-Quantum Preshared Keys (PPK) +********************************* + +Post-Quantum Preshared Keys help provide some quantum resistance to IPSec +tunnels when a post-quantum key exchange algorithm such as ML-KEM is not +available. The use of PPKs in IKEv2 is described in :rfc:`8784`. + +.. cfgmod:: edit vpn authentication ppk + +PPKs can be configued within VyOS under the `vpn ipsec authentication ppk` +config. + +.. cfgmod:: set vpn authentication ppk secret-type + +PPKs need an id and a secret value. The ID and the secret must match if PPKs are +required for a successful IPsec connection. The secret can be plain text, a +hex value, or a Base64 value. The default is plain text. If using another +type of value, you must define the secret type. + +.. cfgmod:: set vpn ipsec site-to-site ppk id + +To use a PPK within a site-to-site or remote access connection, define the PPK +id under the connection. + +.. cfgmod:: set vpn ipsec site-to-site ppk required + +Optionally, you can require the use of PPK to have a successful connection. + +.. cfgmod:: show vpn ipsec connections + +You can view the PPK column for information on if PPK is configured, and +if it is in use. The output is in the format of `` / ``. +The options for configured are none if not conifugred, opt if configured +but optional, and req is configured and required. The in use will show yes +Possible values of the ``configured`` field are ``none`` if not conifgured, ``opt`` if configured +but optional, and ``req`` is configured and required. The in use will show yes + + + + ***************** Configuration IKE ***************** -- cgit v1.2.3