diff options
Diffstat (limited to 'tests/render/cases/ipsec_route_based')
8 files changed, 380 insertions, 0 deletions
diff --git a/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt new file mode 100644 index 0000000..6c4fee4 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_azure/expected/r1.txt @@ -0,0 +1,46 @@ +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Tunnel' +set interfaces vti vti1 ip adjust-mss '1350' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 10.0.0.4 disable-connected-check +set protocols bgp neighbor 10.0.0.4 remote-as 65540 +set protocols bgp neighbor 10.0.0.4 timers holdtime 30 +set protocols bgp neighbor 10.0.0.4 timers keepalive 10 +set protocols bgp system-as 64499 +set protocols static route 10.0.0.4/32 +set protocols static route 10.0.0.4/32 interface 'vti1' +set vpn ipsec authentication psk azure +set vpn ipsec authentication psk azure id 198.51.100.3 +set vpn ipsec authentication psk azure id 203.0.113.2 +set vpn ipsec authentication psk azure secret '********' +set vpn ipsec esp-group AZURE +set vpn ipsec esp-group AZURE lifetime 3600 +set vpn ipsec esp-group AZURE mode tunnel +set vpn ipsec esp-group AZURE pfs dh-group2 +set vpn ipsec esp-group AZURE proposal 1 +set vpn ipsec esp-group AZURE proposal 1 encryption aes256 +set vpn ipsec esp-group AZURE proposal 1 hash sha1 +set vpn ipsec ike-group AZURE +set vpn ipsec ike-group AZURE dead-peer-detection action restart +set vpn ipsec ike-group AZURE dead-peer-detection interval 15 +set vpn ipsec ike-group AZURE dead-peer-detection timeout 30 +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange ikev2 +set vpn ipsec ike-group AZURE lifetime 28800 +set vpn ipsec ike-group AZURE proposal 1 +set vpn ipsec ike-group AZURE proposal 1 dh-group 2 +set vpn ipsec ike-group AZURE proposal 1 encryption aes256 +set vpn ipsec ike-group AZURE proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec site-to-site peer 203.0.113.2 +set vpn ipsec site-to-site peer 203.0.113.2 authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate' +set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' +set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' +set vpn ipsec site-to-site peer 203.0.113.2 remote-address '203.0.113.2' +set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' +set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' diff --git a/tests/render/cases/ipsec_route_based/docs_azure/vars.yml b/tests/render/cases/ipsec_route_based/docs_azure/vars.yml new file mode 100644 index 0000000..0b52694 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_azure/vars.yml @@ -0,0 +1,45 @@ +--- +# docs.vyos.io/en/1.5/configexamples/azure-vpn-bgp.html +ipsec_route_based_peers: + - name: 203.0.113.2 + description: AZURE PRIMARY TUNNEL + psk_name: azure + psk: ch00s3-4-s3cur3-psk + local_address: 10.10.0.5 # private IP; the device is behind NAT + local_id: 198.51.100.3 # public IP + remote_address: 203.0.113.2 + connection_type: initiate + ikev2_reauth: inherit + esp_group_on_vti: true + vti: {interface: vti1, address: 10.10.1.5/32, description: Azure Tunnel, adjust_mss: "1350"} +ipsec_route_based_ike_group: + name: AZURE + key_exchange: ikev2 + ikev2_reauth: true + lifetime: 28800 + proposal_id: 1 + dh_group: 2 + encryption: aes256 + hash: sha1 + dead_peer_detection: {action: restart, interval: 15, timeout: 30} +ipsec_route_based_esp_group: + name: AZURE + lifetime: 3600 + mode: tunnel + pfs: dh-group2 + proposal_id: 1 + encryption: aes256 + hash: sha1 +ipsec_route_based_interfaces: [eth0] +ipsec_route_based_disable_route_autoinstall: false # the page does not set it +ipsec_route_based_interface_routes: + - {dest: 10.0.0.4/32, interface: vti1} +ipsec_route_based_bgp: + asn: 64499 + neighbors: + - address: 10.0.0.4 + remote_as: 65540 + holdtime: 30 + keepalive: 10 + disable_connected_check: true + soft_reconfiguration_inbound: true diff --git a/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt new file mode 100644 index 0000000..d360ddf --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_azure_dual/expected/r1.txt @@ -0,0 +1,69 @@ +set interfaces vti vti1 address '10.10.1.5/32' +set interfaces vti vti1 description 'Azure Primary Tunnel' +set interfaces vti vti1 ip adjust-mss '1350' +set interfaces vti vti2 address '10.10.1.6/32' +set interfaces vti vti2 description 'Azure Secondary Tunnel' +set interfaces vti vti2 ip adjust-mss '1350' +set protocols bgp neighbor 10.0.0.4 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 10.0.0.4 disable-connected-check +set protocols bgp neighbor 10.0.0.4 remote-as 65540 +set protocols bgp neighbor 10.0.0.4 timers holdtime 30 +set protocols bgp neighbor 10.0.0.4 timers keepalive 10 +set protocols bgp neighbor 10.0.0.5 address-family ipv4-unicast soft-reconfiguration inbound +set protocols bgp neighbor 10.0.0.5 disable-connected-check +set protocols bgp neighbor 10.0.0.5 remote-as 65540 +set protocols bgp neighbor 10.0.0.5 timers holdtime 30 +set protocols bgp neighbor 10.0.0.5 timers keepalive 10 +set protocols bgp system-as 64499 +set protocols static route 10.0.0.4/32 +set protocols static route 10.0.0.4/32 interface 'vti1' +set protocols static route 10.0.0.5/32 +set protocols static route 10.0.0.5/32 interface 'vti2' +set vpn ipsec authentication psk azure +set vpn ipsec authentication psk azure id 198.51.100.3 +set vpn ipsec authentication psk azure id 203.0.113.2 +set vpn ipsec authentication psk azure id 203.0.113.3 +set vpn ipsec authentication psk azure secret '********' +set vpn ipsec esp-group AZURE +set vpn ipsec esp-group AZURE lifetime 3600 +set vpn ipsec esp-group AZURE mode tunnel +set vpn ipsec esp-group AZURE pfs dh-group2 +set vpn ipsec esp-group AZURE proposal 1 +set vpn ipsec esp-group AZURE proposal 1 encryption aes256 +set vpn ipsec esp-group AZURE proposal 1 hash sha1 +set vpn ipsec ike-group AZURE +set vpn ipsec ike-group AZURE dead-peer-detection action restart +set vpn ipsec ike-group AZURE dead-peer-detection interval 15 +set vpn ipsec ike-group AZURE dead-peer-detection timeout 30 +set vpn ipsec ike-group AZURE ikev2-reauth +set vpn ipsec ike-group AZURE key-exchange ikev2 +set vpn ipsec ike-group AZURE lifetime 28800 +set vpn ipsec ike-group AZURE proposal 1 +set vpn ipsec ike-group AZURE proposal 1 dh-group 2 +set vpn ipsec ike-group AZURE proposal 1 encryption aes256 +set vpn ipsec ike-group AZURE proposal 1 hash sha1 +set vpn ipsec interface eth0 +set vpn ipsec site-to-site peer azure-primary +set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary connection-type 'initiate' +set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL' +set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2' +set vpn ipsec site-to-site peer azure-primary vti bind 'vti1' +set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE' +set vpn ipsec site-to-site peer azure-secondary +set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3' +set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate' +set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL' +set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE' +set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit' +set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5' +set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3' +set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2' +set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE' diff --git a/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml b/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml new file mode 100644 index 0000000..4054b68 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_azure_dual/vars.yml @@ -0,0 +1,64 @@ +--- +# docs.vyos.io/en/1.5/configexamples/azure-vpn-dual-bgp.html +# Both peers share the PSK entry "azure" (one entry, three ids), as on the page. +ipsec_route_based_peers: + - name: azure-primary + description: AZURE PRIMARY TUNNEL + psk_name: azure + psk: ch00s3-4-s3cur3-psk + local_address: 10.10.0.5 # private IP; the device is behind NAT + local_id: 198.51.100.3 # public IP + remote_address: 203.0.113.2 + connection_type: initiate + ikev2_reauth: inherit + esp_group_on_vti: true + vti: {interface: vti1, address: 10.10.1.5/32, description: Azure Primary Tunnel, adjust_mss: "1350"} + - name: azure-secondary + description: AZURE secondary TUNNEL + psk_name: azure + psk: ch00s3-4-s3cur3-psk + local_address: 10.10.0.5 + local_id: 198.51.100.3 + remote_address: 203.0.113.3 + connection_type: initiate + ikev2_reauth: inherit + esp_group_on_vti: true + vti: {interface: vti2, address: 10.10.1.6/32, description: Azure Secondary Tunnel, adjust_mss: "1350"} +ipsec_route_based_ike_group: + name: AZURE + key_exchange: ikev2 + ikev2_reauth: true + lifetime: 28800 + proposal_id: 1 + dh_group: 2 + encryption: aes256 + hash: sha1 + dead_peer_detection: {action: restart, interval: 15, timeout: 30} +ipsec_route_based_esp_group: + name: AZURE + lifetime: 3600 + mode: tunnel + pfs: dh-group2 + proposal_id: 1 + encryption: aes256 + hash: sha1 +ipsec_route_based_interfaces: [eth0] +ipsec_route_based_disable_route_autoinstall: false # the page does not set it +ipsec_route_based_interface_routes: + - {dest: 10.0.0.4/32, interface: vti1} + - {dest: 10.0.0.5/32, interface: vti2} +ipsec_route_based_bgp: + asn: 64499 + neighbors: + - address: 10.0.0.4 + remote_as: 65540 + holdtime: 30 + keepalive: 10 + disable_connected_check: true + soft_reconfiguration_inbound: true + - address: 10.0.0.5 + remote_as: 65540 + holdtime: 30 + keepalive: 10 + disable_connected_check: true + soft_reconfiguration_inbound: true diff --git a/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt new file mode 100644 index 0000000..aa551b3 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_cisco/expected/r1.txt @@ -0,0 +1,45 @@ +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area '0' +set protocols ospf area 0 network 10.100.100.0/30 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 192.168.1.0/24 +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network point-to-point +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.1.1' +set vpn ipsec authentication psk AUTH-PSK +set vpn ipsec authentication psk AUTH-PSK id 10.0.1.2 +set vpn ipsec authentication psk AUTH-PSK id 10.0.2.2 +set vpn ipsec authentication psk AUTH-PSK secret '********' +set vpn ipsec authentication psk AUTH-PSK secret-type base64 +set vpn ipsec esp-group ESP-GROUP +set vpn ipsec esp-group ESP-GROUP lifetime 3600 +set vpn ipsec esp-group ESP-GROUP pfs disable +set vpn ipsec esp-group ESP-GROUP proposal 10 +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256 +set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256 +set vpn ipsec ike-group IKE-GROUP +set vpn ipsec ike-group IKE-GROUP close-action start +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action restart +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval 10 +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout 30 +set vpn ipsec ike-group IKE-GROUP key-exchange ikev1 +set vpn ipsec ike-group IKE-GROUP lifetime 28800 +set vpn ipsec ike-group IKE-GROUP proposal 10 +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 14 +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes128 +set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha1 +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer CISCO +set vpn ipsec site-to-site peer CISCO authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer CISCO authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer CISCO authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer CISCO connection-type 'initiate' +set vpn ipsec site-to-site peer CISCO default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer CISCO ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer CISCO local-address '10.0.1.2' +set vpn ipsec site-to-site peer CISCO remote-address '10.0.2.2' +set vpn ipsec site-to-site peer CISCO vti bind 'vti1' diff --git a/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml b/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml new file mode 100644 index 0000000..a7f5c4d --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_cisco/vars.yml @@ -0,0 +1,33 @@ +--- +# docs.vyos.io/en/1.5/configexamples/ipsec-cisco-route-based.html - VyOS side. +# WAN/LAN addresses (eth0-eth2) belong to the base role. +ipsec_route_based_peers: + - name: CISCO + local_address: 10.0.1.2 + remote_address: 10.0.2.2 + psk: dGVzdA== + psk_type: base64 + psk_name: AUTH-PSK + connection_type: initiate + vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438} +ipsec_route_based_ike_group: + name: IKE-GROUP + key_exchange: ikev1 + lifetime: 28800 + dh_group: 14 + encryption: aes128 + hash: sha1 + close_action: start + dead_peer_detection: {action: restart, interval: 10, timeout: 30} +ipsec_route_based_esp_group: + name: ESP-GROUP + lifetime: 3600 + pfs: disable + encryption: aes256 + hash: sha256 +ipsec_route_based_ospf: + router_id: 2.2.2.2 + area: "0" + networks: [10.100.100.0/30, 192.168.0.0/24, 192.168.1.0/24] + passive_interfaces: [eth1, eth2] +ipsec_route_based_default_gateway: 10.0.1.1 diff --git a/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt b/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt new file mode 100644 index 0000000..4c50bcd --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_palo_alto/expected/r1.txt @@ -0,0 +1,45 @@ +set interfaces vti vti1 address '10.100.100.1/30' +set interfaces vti vti1 mtu '1438' +set protocols ospf area '0' +set protocols ospf area 0 network 10.100.100.0/30 +set protocols ospf area 0 network 192.168.0.0/24 +set protocols ospf area 0 network 192.168.1.0/24 +set protocols ospf interface eth1 passive +set protocols ospf interface eth2 passive +set protocols ospf interface vti1 network point-to-point +set protocols ospf parameters router-id '2.2.2.2' +set protocols static route 0.0.0.0/0 +set protocols static route 0.0.0.0/0 next-hop '10.0.1.1' +set vpn ipsec authentication psk AUTH-PSK +set vpn ipsec authentication psk AUTH-PSK id 10.0.1.2 +set vpn ipsec authentication psk AUTH-PSK id 10.0.2.2 +set vpn ipsec authentication psk AUTH-PSK secret '********' +set vpn ipsec authentication psk AUTH-PSK secret-type base64 +set vpn ipsec esp-group ESP-GROUP +set vpn ipsec esp-group ESP-GROUP lifetime 3600 +set vpn ipsec esp-group ESP-GROUP pfs disable +set vpn ipsec esp-group ESP-GROUP proposal 10 +set vpn ipsec esp-group ESP-GROUP proposal 10 encryption aes256 +set vpn ipsec esp-group ESP-GROUP proposal 10 hash sha256 +set vpn ipsec ike-group IKE-GROUP +set vpn ipsec ike-group IKE-GROUP close-action start +set vpn ipsec ike-group IKE-GROUP dead-peer-detection action restart +set vpn ipsec ike-group IKE-GROUP dead-peer-detection interval 10 +set vpn ipsec ike-group IKE-GROUP dead-peer-detection timeout 30 +set vpn ipsec ike-group IKE-GROUP key-exchange ikev1 +set vpn ipsec ike-group IKE-GROUP lifetime 28800 +set vpn ipsec ike-group IKE-GROUP proposal 10 +set vpn ipsec ike-group IKE-GROUP proposal 10 dh-group 14 +set vpn ipsec ike-group IKE-GROUP proposal 10 encryption aes128 +set vpn ipsec ike-group IKE-GROUP proposal 10 hash sha1 +set vpn ipsec options disable-route-autoinstall +set vpn ipsec site-to-site peer PA +set vpn ipsec site-to-site peer PA authentication local-id '10.0.1.2' +set vpn ipsec site-to-site peer PA authentication mode 'pre-shared-secret' +set vpn ipsec site-to-site peer PA authentication remote-id '10.0.2.2' +set vpn ipsec site-to-site peer PA connection-type 'initiate' +set vpn ipsec site-to-site peer PA default-esp-group 'ESP-GROUP' +set vpn ipsec site-to-site peer PA ike-group 'IKE-GROUP' +set vpn ipsec site-to-site peer PA local-address '10.0.1.2' +set vpn ipsec site-to-site peer PA remote-address '10.0.2.2' +set vpn ipsec site-to-site peer PA vti bind 'vti1' diff --git a/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml b/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml new file mode 100644 index 0000000..9e8e814 --- /dev/null +++ b/tests/render/cases/ipsec_route_based/docs_palo_alto/vars.yml @@ -0,0 +1,33 @@ +--- +# docs.vyos.io/en/1.5/configexamples/ipsec-pa-route-based.html - VyOS side. +# WAN/LAN addresses (eth0-eth2) belong to the base role. +ipsec_route_based_peers: + - name: PA + local_address: 10.0.1.2 + remote_address: 10.0.2.2 + psk: dGVzdA== + psk_type: base64 + psk_name: AUTH-PSK + connection_type: initiate + vti: {interface: vti1, address: 10.100.100.1/30, mtu: 1438} +ipsec_route_based_ike_group: + name: IKE-GROUP + key_exchange: ikev1 + lifetime: 28800 + dh_group: 14 + encryption: aes128 + hash: sha1 + close_action: start + dead_peer_detection: {action: restart, interval: 10, timeout: 30} +ipsec_route_based_esp_group: + name: ESP-GROUP + lifetime: 3600 + pfs: disable + encryption: aes256 + hash: sha256 +ipsec_route_based_ospf: + router_id: 2.2.2.2 + area: "0" + networks: [10.100.100.0/30, 192.168.0.0/24, 192.168.1.0/24] + passive_interfaces: [eth1, eth2] +ipsec_route_based_default_gateway: 10.0.1.1 |