From e18b63c7b7e82c03d0ecafe627fd3f8859115159 Mon Sep 17 00:00:00 2001 From: Ruben Herold Date: Tue, 6 Oct 2026 10:26:42 +0200 Subject: vpn: document disable-mobike, disable-uniqreqids, eap-id and L2TP IPsec settings --- docs/configuration/vpn/ipsec/ipsec_general.md | 21 ++++++++++++++ docs/configuration/vpn/ipsec/remoteaccess_ipsec.md | 11 ++++++++ docs/configuration/vpn/l2tp.md | 32 ++++++++++++++++++++++ 3 files changed, 64 insertions(+) (limited to 'docs') diff --git a/docs/configuration/vpn/ipsec/ipsec_general.md b/docs/configuration/vpn/ipsec/ipsec_general.md index 62fcec8a..3d5d39cf 100644 --- a/docs/configuration/vpn/ipsec/ipsec_general.md +++ b/docs/configuration/vpn/ipsec/ipsec_general.md @@ -169,6 +169,14 @@ VyOS IKE group has the next options: required IKE/IPsec SAs. * **start** - Tries to immediately re-create the CHILD_SA. +.. cfgcmd:: set vpn ipsec ike-group disable-mobike + + Disable MOBIKE (IKEv2 Mobility and Multihoming, :rfc:`4555`) for + connections that use this IKE group. MOBIKE is enabled by default and + allows a peer to move an IKE SA to a new IP address without + re-establishing the tunnel. Disable it if the remote peer does not + handle MOBIKE correctly. It has no effect on IKEv1. + .. cfgcmd:: set vpn ipsec ike-group ikev2-reauth Whether rekeying of an IKE_SA should also reauthenticate @@ -314,6 +322,19 @@ VyOS ESP group has the next options: Global IPsec Settings ===================== +.. cfgcmd:: set vpn ipsec disable-uniqreqids + + Do not enforce unique IKE identities. By default a new IKE_SA replaces an + existing one that uses the same remote identity, and the existing one is + closed. With this option set, several IKE_SAs with the same identity can + exist at the same time, for example when multiple clients or sites + authenticate with the same identity. + + The option applies to site-to-site peers, profiles and L2TP/IPsec. A + ``unique`` setting on an individual site-to-site peer takes precedence. + It is not used for ``remote-access`` connections, which use their own + ``unique`` setting. + .. cfgcmd:: set vpn ipsec interface Interface name to restrict outbound IPsec policies. There is a possibility diff --git a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md index 6931e00b..7a4440e5 100644 --- a/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md +++ b/docs/configuration/vpn/ipsec/remoteaccess_ipsec.md @@ -143,6 +143,17 @@ requested. set vpn ipsec remote-access connection rw authentication always-send-cert ``` +With the `eap-tls`, `eap-mschapv2` and `eap-radius` client modes the server +asks the client for its EAP identity. By default any identity is accepted. +To accept only a specific identity, set it explicitly: + +```{cfgcmd} set vpn ipsec remote-access connection \ authentication eap-id \ + +EAP identity the client must present. The identity is a string of up to 64 +ASCII characters, the default `any` accepts every identity. The option has no +effect with the `x509` client mode. +``` + ## Client Configuration diff --git a/docs/configuration/vpn/l2tp.md b/docs/configuration/vpn/l2tp.md index 3b131b98..7746666f 100644 --- a/docs/configuration/vpn/l2tp.md +++ b/docs/configuration/vpn/l2tp.md @@ -82,6 +82,38 @@ Set mode for IPsec authentication between VyOS and L2TP clients. Set predefined shared secret phrase. ``` + +```{cfgcmd} set vpn l2tp remote-access ipsec-settings ike-group \ + +Use the settings of an existing `vpn ipsec ike-group` for the IKE +negotiation, instead of the built-in defaults. The group must exist, the +commit fails otherwise. +``` + + +```{cfgcmd} set vpn l2tp remote-access ipsec-settings esp-group \ + +Use the settings of an existing `vpn ipsec esp-group` for the ESP +negotiation, instead of the built-in defaults. The group must exist, the +commit fails otherwise. +``` + + +```{cfgcmd} set vpn l2tp remote-access ipsec-settings ike-lifetime \ + +IKE lifetime in seconds, from 30 to 86400. The default is 3600 seconds. The +value is only used when no `ike-group` is configured, otherwise the `lifetime` +of the IKE group applies. +``` + + +```{cfgcmd} set vpn l2tp remote-access ipsec-settings lifetime \ + +ESP lifetime in seconds, from 30 to 86400. The default is 3600 seconds. The +value is only used when no `esp-group` is configured, otherwise the `lifetime` +of the ESP group applies. +``` + If a local firewall policy is in place on your external interface you will need to allow the ports below: - UDP port 500 (IKE) -- cgit v1.2.3