From 899a6bf7955592ec40670944a860a1bee97b432c Mon Sep 17 00:00:00 2001 From: omnom62 <75066712+omnom62@users.noreply.github.com> Date: Fri, 21 Aug 2026 22:12:11 +1000 Subject: T8321: vpn_ipsec modules (#489) Add VPN IPsec module --- docs/vyos.vyos.vyos_vpn_ipsec_module.rst | 1553 ++++++++++++++++++++++++++ docs/vyos.vyos.vyos_vpn_ipsec_s2s_module.rst | 1232 ++++++++++++++++++++ 2 files changed, 2785 insertions(+) create mode 100644 docs/vyos.vyos.vyos_vpn_ipsec_module.rst create mode 100644 docs/vyos.vyos.vyos_vpn_ipsec_s2s_module.rst (limited to 'docs') diff --git a/docs/vyos.vyos.vyos_vpn_ipsec_module.rst b/docs/vyos.vyos.vyos_vpn_ipsec_module.rst new file mode 100644 index 00000000..79ca84b8 --- /dev/null +++ b/docs/vyos.vyos.vyos_vpn_ipsec_module.rst @@ -0,0 +1,1553 @@ +.. _vyos.vyos.vyos_vpn_ipsec_module: + + +************************ +vyos.vyos.vyos_vpn_ipsec +************************ + +**Manages global IPsec (ike-group, esp-group, profile, authentication, options) attributes of VyOS network devices.** + + +Version added: 1.0.0 + +.. contents:: + :local: + :depth: 1 + + +Synopsis +-------- +- This module manages global VPN IPsec configuration on VyOS devices -- IKE groups, ESP groups, PSK/PPK authentication, IPsec profiles, and global options. Site-to-site peers and IKEv2 remote-access connections are handled by separate modules. + + + + +Parameters +---------- + +.. raw:: html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ParameterChoices/DefaultsComments
+
+ config + +
+ dictionary +
+ 		+ +
IPsec global configuration.
+
+
+ authentication + +
+ dictionary +
+ 		+ +
Global pre-shared-key and post-quantum pre-shared-key definitions.
+
+
+ ppk + +
+ list + / elements=dictionary +
+ 		+ +
List of post-quantum pre-shared keys.
+
+
+ id + +
+ list + / elements=string +
+ 		+ +
ID(s) for PPK.
+
+
+ name + +
+ string + / required +
+ 		+ +
Post-quantum pre-shared key name.
+
+
+ secret + +
+ string +
+ 		+ +
Post-quantum pre-shared secret key.
+
+
+ secret_type + +
+ string +
+ 		+
    Choices: +
  • base64
    • +
  • hex
    • +
  • plaintext
    • +
+ 		+
Secret encoding type.
+
+
+ psk + +
+ list + / elements=dictionary +
+ 		+ +
List of pre-shared keys.
+
+
+ dhcp_interface + +
+ list + / elements=string +
+ 		+ +
DHCP interface(s) supplying next-hop IP address.
+
+
+ id + +
+ list + / elements=string +
+ 		+ +
ID(s) for authentication.
+
+
+ name + +
+ string + / required +
+ 		+ +
Pre-shared key name.
+
+
+ secret + +
+ string +
+ 		+ +
IKE pre-shared secret key.
+
+
+ secret_type + +
+ string +
+ 		+
    Choices: +
  • base64
    • +
  • hex
    • +
  • plaintext
    • +
+ 		+
Secret encoding type.
+
+
+ disable_uniqreqids + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Disable requirement for unique IDs in the Security Database.
+
+
+ esp_group + +
+ list + / elements=dictionary +
+ 		+ +
List of ESP groups.
+
+
+ compression + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Enable ESP compression.
+
+
+ disable_rekey + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Do not locally initiate a re-key of the SA; remote peer must re-key before expiration.
+
+
+ life_bytes + +
+ integer +
+ 		+ +
Security Association byte count to expire.
+
+
+ life_packets + +
+ integer +
+ 		+ +
Security Association packet count to expire.
+
+
+ lifetime + +
+ integer +
+ 		+ +
Security Association time to expire, in seconds.
+
+
+ mode + +
+ string +
+ 		+
    Choices: +
  • tunnel
    • +
  • transport
    • +
+ 		+
ESP mode.
+
+
+ name + +
+ string + / required +
+ 		+ +
The name of the ESP group.
+
+
+ pfs + +
+ string +
+ 		+ +
ESP Perfect Forward Secrecy. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side, not enumerated here since the set is version-dependent.
+
+
+ proposal + +
+ list + / elements=dictionary +
+ 		+ +
List of ESP proposals.
+
+
+ encryption + +
+ string +
+ 		+ +
Encryption algorithm. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side, not enumerated here since the set is version-dependent.
+
+
+ hash + +
+ string +
+ 		+ +
Hash algorithm. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side.
+
+
+ proposal_id + +
+ integer +
+ 		+ +
The proposal identifier.
+
+
+ ike_group + +
+ list + / elements=dictionary +
+ 		+ +
List of IKE groups.
+
+
+ close_action + +
+ string +
+ 		+
    Choices: +
  • none
    • +
  • trap
    • +
  • start
    • +
+ 		+
Action to take if a child SA is unexpectedly closed.
+
+
+ dead_peer_detection + +
+ dictionary +
+ 		+ +
Dead Peer Detection (DPD).
+
+
+ action + +
+ string +
+ 		+
    Choices: +
  • trap
    • +
  • clear
    • +
  • restart
    • +
+ 		+
Keep-alive failure action.
+
+
+ interval + +
+ integer +
+ 		+ +
Keep-alive interval in seconds.
+
+
+ timeout + +
+ integer +
+ 		+ +
Dead Peer Detection keep-alive timeout (IKEv1 only), in seconds.
+
+
+ disable_mobike + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Disable MOBIKE support (IKEv2 only).
+
+
+ ikev2_reauth + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Re-authentication of the remote peer during an IKE re-key (IKEv2 only).
+
+
+ key_exchange + +
+ string +
+ 		+
    Choices: +
  • ikev1
    • +
  • ikev2
    • +
+ 		+
IKE version.
+
+
+ lifetime + +
+ integer +
+ 		+ +
IKE lifetime in seconds.
+
+
+ mode + +
+ string +
+ 		+
    Choices: +
  • main
    • +
  • aggressive
    • +
+ 		+
IKEv1 phase 1 mode.
+
+
+ name + +
+ string + / required +
+ 		+ +
The name of the IKE group.
+
+
+ proposal + +
+ list + / elements=dictionary +
+ 		+ +
List of IKE proposals.
+
+
+ dh_group + +
+ integer +
+ 		+ +
Diffie-Hellman group. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side, not enumerated here since the set is version-dependent.
+
+
+ encryption + +
+ string +
+ 		+ +
Encryption algorithm. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side, not enumerated here since the set is version-dependent.
+
+
+ hash + +
+ string +
+ 		+ +
Hash algorithm. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side.
+
+
+ prf + +
+ string +
+ 		+ +
Pseudo-Random Function. See VyOS/strongSwan documentation for the full set of valid values -- validated device-side.
+
+
+ proposal_id + +
+ integer +
+ 		+ +
The proposal identifier.
+
+
+ interface + +
+ list + / elements=string +
+ 		+ +
Interface(s) IPsec listens on. If omitted, listens on all interfaces.
+
+
+ log + +
+ dictionary +
+ 		+ +
IPsec logging settings.
+
+
+ level + +
+ integer +
+ 		+ +
Global IPsec logging level.
+
+
+ subsystem + +
+ list + / elements=string +
+ 		+ +
Per-subsystem logging levels to enable.
+
+
+ options + +
+ dictionary +
+ 		+ +
Global IPsec options.
+
+
+ disable_route_autoinstall + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Do not automatically install routes to remote networks.
+
+
+ flexvpn + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Allow FlexVPN vendor ID payload (IKEv2 only).
+
+
+ interface + +
+ string +
+ 		+ +
Single interface for IPsec options scope (distinct from top-level interface list).
+
+
+ retransmission + +
+ dictionary +
+ 		+ +
IPsec retransmission settings.
+
+
+ attempts + +
+ integer +
+ 		+ +
Maximum number of retransmissions.
+
+
+ base + +
+ float +
+ 		+ +
Base of exponential backoff.
+
+
+ timeout + +
+ integer +
+ 		+ +
Timeout in seconds before the first retransmission.
+
+
+ virtual_ip + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Allow install of virtual-ip addresses.
+
+
+ profile + +
+ list + / elements=dictionary +
+ 		+ +
List of VPN IPsec profiles (used for e.g. DMVPN/GRE tunnel binding).
+
+
+ authentication + +
+ dictionary +
+ 		+ +
Authentication settings for this profile.
+
+
+ mode + +
+ string +
+ 		+
    Choices: +
  • pre-shared-secret
    • +
+ 		+
Authentication mode.
+
+
+ pre_shared_secret + +
+ string +
+ 		+ +
Pre-shared secret key.
+
+
+ bind_tunnel + +
+ list + / elements=string +
+ 		+ +
Tunnel interface(s) associated with this profile.
+
+
+ disable + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Disable this profile.
+
+
+ esp_group + +
+ string +
+ 		+ +
ESP group name to use for this profile.
+
+
+ ike_group + +
+ string +
+ 		+ +
IKE group name to use for this profile.
+
+
+ name + +
+ string + / required +
+ 		+ +
Profile name.
+
+
+ running_config + +
+ string +
+ 		+ +
This option is used only with state parsed.
+
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | match "vpn ipsec".
+
The states replaced and overridden have identical behaviour for this module with respect to named collections (ike_group, esp_group, profile, authentication), but differ in scope -- see the module description for detail.
+
The state parsed reads the configuration from the running_config option and transforms it into Ansible structured data as per the resource module's argspec, returned in the parsed key within the result.
+
+
+ state + +
+ string +
+ 		+
    Choices: +
  • merged ←
    • +
  • replaced
    • +
  • overridden
    • +
  • deleted
    • +
  • gathered
    • +
  • rendered
    • +
  • parsed
    • +
+ 		+
The state the configuration should be left in.
+
+
+ + +Notes +----- + +.. note:: + - Tested against VyOS 1.4 and 1.5. + - Source of truth for field types/choices: device node.def templates under /opt/vyatta/share/vyatta-cfg/templates/vpn/ipsec/. + - For more information on using Ansible to manage network devices see the :ref:`Ansible Network Guide ` + + + +Examples +-------- + +.. code-block:: yaml + + - name: Merge provided configuration with device configuration + vyos.vyos.vyos_vpn_ipsec: + config: + esp_group: + - name: ESP-TEST + proposal: + - proposal_id: 1 + encryption: aes256 + hash: sha256 + ike_group: + - name: IKE-TEST + key_exchange: ikev2 + proposal: + - proposal_id: 1 + encryption: aes256 + hash: sha256 + dh_group: 14 + state: merged + + - name: Replace one named esp-group, leaving all other groups untouched + vyos.vyos.vyos_vpn_ipsec: + config: + esp_group: + - name: ESP-TEST + proposal: + - proposal_id: 1 + encryption: aes128 + hash: sha256 + state: replaced + + - name: Override the whole configuration -- anything not listed here is removed + vyos.vyos.vyos_vpn_ipsec: + config: + esp_group: + - name: ESP-TEST + proposal: + - proposal_id: 1 + encryption: aes256 + hash: sha256 + state: overridden + + - name: Delete one named esp-group, leaving all other groups untouched + vyos.vyos.vyos_vpn_ipsec: + config: + esp_group: + - name: ESP-TEST + state: deleted + + - name: Remove all vpn_ipsec configuration + vyos.vyos.vyos_vpn_ipsec: + state: deleted + + - name: Gather current vpn_ipsec configuration + vyos.vyos.vyos_vpn_ipsec: + state: gathered + + - name: Render configuration without touching the device + vyos.vyos.vyos_vpn_ipsec: + config: + esp_group: + - name: ESP-TEST + proposal: + - proposal_id: 1 + encryption: aes256 + hash: sha256 + state: rendered + + - name: Parse raw config text into structured facts + vyos.vyos.vyos_vpn_ipsec: + running_config: "{{ lookup('file', './vpn_ipsec.cfg') }}" + state: parsed + + + +Return Values +------------- +Common return values are documented `here `_, the following are the fields unique to this module: + +.. raw:: html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
KeyReturnedDescription
+
+ after + +
+ dictionary +
+ 		when changed +
The resulting configuration after module execution.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ before + +
+ dictionary +
+ 		when state is merged, replaced, overridden or deleted +
The configuration prior to the module execution.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ commands + +
+ list +
+ 		when state is merged, replaced, overridden or deleted +
The set of commands pushed to the remote device.
+
+
Sample:
+
['set vpn ipsec esp-group ESP-TEST proposal 1 encryption aes256', 'set vpn ipsec ike-group IKE-TEST key-exchange ikev2']
+
+
+ gathered + +
+ dictionary +
+ 		when state is gathered +
Facts about the network resource gathered from the remote device as structured data.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ parsed + +
+ dictionary +
+ 		when state is parsed +
The device native config provided in running_config option parsed into structured data as per module argspec.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ rendered + +
+ list +
+ 		when state is rendered +
The provided configuration in the task rendered in device-native format (offline).
+
+
Sample:
+
['set vpn ipsec esp-group ESP-TEST proposal 1 encryption aes256']
+
+

+ + +Status +------ + + +Authors +~~~~~~~ + +- Evgeny Molotkov (@omnom62) diff --git a/docs/vyos.vyos.vyos_vpn_ipsec_s2s_module.rst b/docs/vyos.vyos.vyos_vpn_ipsec_s2s_module.rst new file mode 100644 index 00000000..8da5dc8a --- /dev/null +++ b/docs/vyos.vyos.vyos_vpn_ipsec_s2s_module.rst @@ -0,0 +1,1232 @@ +.. _vyos.vyos.vyos_vpn_ipsec_s2s_module: + + +**************************** +vyos.vyos.vyos_vpn_ipsec_s2s +**************************** + +**Manages IPsec site-to-site VPN peers on VyOS network devices.** + + +Version added: 1.0.0 + +.. contents:: + :local: + :depth: 1 + + +Synopsis +-------- +- This module manages VPN IPsec site-to-site peer configuration on VyOS devices -- policy-based tunnels and route-based (VTI) connections. IKE/ESP groups, PSK/PPK authentication, and IPsec profiles are managed by the separate vyos_vpn_ipsec module; peers here reference those by name. + + + + +Parameters +---------- + +.. raw:: html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
ParameterChoices/DefaultsComments
+
+ config + +
+ dictionary +
+ 		+ +
IPsec site-to-site configuration.
+
+
+ peer + +
+ list + / elements=dictionary +
+ 		+ +
List of site-to-site peers.
+
+
+ authentication + +
+ dictionary +
+ 		+ +
Peer authentication settings.
+
+
+ local_id + +
+ string +
+ 		+ +
Local ID for peer authentication.
+
+
+ mode + +
+ string +
+ 		+
    Choices: +
  • pre-shared-secret
    • +
  • rsa
    • +
  • x509
    • +
+ 		+
Authentication mode.
+
+
+ ppk + +
+ dictionary +
+ 		+ +
Post-quantum preshared key reference for this peer.
+
+
+ id + +
+ string +
+ 		+ +
Post-quantum preshared key ID for this connection.
+
+
+ required + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Require a valid PPK for the connection to establish.
+
+
+ remote_id + +
+ string +
+ 		+ +
ID for remote authentication.
+
+
+ rsa + +
+ dictionary +
+ 		+ +
RSA key authentication.
+
+
+ local_key + +
+ string +
+ 		+ +
Name of the PKI key-pair with the local private key.
+
+
+ passphrase + +
+ string +
+ 		+ +
Local private key passphrase.
+
+
+ remote_key + +
+ string +
+ 		+ +
Name of the PKI key-pair with the remote public key.
+
+
+ use_x509_id + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Use certificate common name as ID.
+
+
+ x509 + +
+ dictionary +
+ 		+ +
X.509 certificate authentication.
+
+
+ ca_certificate + +
+ list + / elements=string +
+ 		+ +
Certificate Authority chain in PKI configuration.
+
+
+ certificate + +
+ string +
+ 		+ +
Certificate in PKI configuration.
+
+
+ passphrase + +
+ string +
+ 		+ +
Private key passphrase.
+
+
+ childless + +
+ string +
+ 		+
    Choices: +
  • allow
    • +
  • prefer
    • +
  • force
    • +
  • never
    • +
+ 		+
Childless IKE SA initiation support.
+
+
+ connection_type + +
+ string +
+ 		+
    Choices: +
  • initiate
    • +
  • trap
    • +
  • none
    • +
+ 		+
Connection type.
+
+
+ default_esp_group + +
+ string +
+ 		+ +
Default ESP group name for tunnels under this peer that don't specify their own.
+
+
+ description + +
+ string +
+ 		+ +
Description.
+
+
+ dhcp_interface + +
+ string +
+ 		+ +
DHCP interface supplying the next-hop IP address.
+
+
+ disable + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Disable this peer.
+
+
+ force_udp_encapsulation + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Force UDP encapsulation.
+
+
+ ike_group + +
+ string +
+ 		+ +
IKE group name.
+
+
+ ikev2_reauth + +
+ string +
+ 		+
    Choices: +
  • yes
    • +
  • no
    • +
  • inherit
    • +
+ 		+
Re-authentication of the remote peer during an IKE re-key (IKEv2 only).
+
+
+ local_address + +
+ string +
+ 		+ +
IPv4 or IPv6 address of a local interface to use for the VPN, or "any".
+
+
+ name + +
+ string + / required +
+ 		+ +
Connection name of the peer.
+
+
+ remote_address + +
+ list + / elements=string +
+ 		+ +
IPv4 or IPv6 address(es) of the remote peer, or "any".
+
+
+ replay_window + +
+ integer +
+ 		+ +
IPsec replay window to configure for this CHILD_SA.
+
+
+ tunnel + +
+ list + / elements=dictionary +
+ 		+ +
Policy-based tunnel definitions for this peer.
+
+
+ disable + +
+ boolean +
+ 		+
    Choices: +
  • no
    • +
  • yes
    • +
+ 		+
Disable this tunnel.
+
+
+ esp_group + +
+ string +
+ 		+ +
ESP group name for this tunnel (overrides the peer's default_esp_group).
+
+
+ local + +
+ dictionary +
+ 		+ +
Local traffic selector for this tunnel.
+
+
+ port + +
+ integer +
+ 		+ +
Local port to match.
+
+
+ prefix + +
+ list + / elements=string +
+ 		+ +
Local IPv4 or IPv6 prefix(es) to match.
+
+
+ priority + +
+ integer +
+ 		+ +
Priority for this IPsec policy (lowest value is most preferred).
+
+
+ protocol + +
+ string +
+ 		+ +
Protocol to match for this tunnel's traffic selector.
+
+
+ remote + +
+ dictionary +
+ 		+ +
Remote traffic selector for this tunnel.
+
+
+ port + +
+ integer +
+ 		+ +
Remote port to match.
+
+
+ prefix + +
+ list + / elements=string +
+ 		+ +
Remote IPv4 or IPv6 prefix(es) to match.
+
+
+ tunnel_id + +
+ integer + / required +
+ 		+ +
The tunnel identifier.
+
+
+ virtual_address + +
+ list + / elements=string +
+ 		+ +
Initiator-requested virtual address(es) from the peer.
+
+
+ vti + +
+ dictionary +
+ 		+ +
Route-based (VTI) connection settings for this peer.
+
+
+ bind + +
+ string +
+ 		+ +
VTI tunnel interface associated with this connection.
+
+
+ esp_group + +
+ string +
+ 		+ +
ESP group name for this VTI connection.
+
+
+ traffic_selector + +
+ dictionary +
+ 		+ +
Traffic selector for the VTI connection.
+
+
+ local + +
+ dictionary +
+ 		+ +
Local traffic-selector parameters.
+
+
+ prefix + +
+ list + / elements=string +
+ 		+ +
Local IPv4 or IPv6 prefix(es).
+
+
+ remote + +
+ dictionary +
+ 		+ +
Remote traffic-selector parameters.
+
+
+ prefix + +
+ list + / elements=string +
+ 		+ +
Remote IPv4 or IPv6 prefix(es).
+
+
+ running_config + +
+ string +
+ 		+ +
This option is used only with state parsed.
+
The value of this option should be the output received from the VyOS device by executing the command show configuration commands | match "vpn ipsec site-to-site".
+
The state parsed reads the configuration from the running_config option and transforms it into Ansible structured data as per the resource module's argspec, returned in the parsed key within the result.
+
+
+ state + +
+ string +
+ 		+
    Choices: +
  • merged ←
    • +
  • replaced
    • +
  • overridden
    • +
  • deleted
    • +
  • gathered
    • +
  • rendered
    • +
  • parsed
    • +
+ 		+
The state the configuration should be left in.
+
+
+ + +Notes +----- + +.. note:: + - Tested against VyOS 1.4 and 1.5. + - Source of truth: vyos-1x's interface-definitions/vpn_ipsec.xml.in, resolved and drafted via this collection's fetch_vyos_xml_definition.py / parse_xml_definitions.py helper scripts, then hand-reviewed. + - The argspec only requires *name* on a peer, but VyOS itself enforces several more requirements at commit time -- confirmed via real device testing, not visible in the argspec: every peer needs ``authentication``, a real ``remote_address`` (not just omitted), a ``local_address`` or ``dhcp_interface``, and at least one of ``tunnel`` or ``vti``. A peer missing any of these will pass Ansible's own argument validation but fail the device commit with a specific error naming what's missing. + - For more information on using Ansible to manage network devices see the :ref:`Ansible Network Guide ` + + + +Examples +-------- + +.. code-block:: yaml + + - name: Merge a site-to-site peer + vyos.vyos.vyos_vpn_ipsec_s2s: + config: + peer: + - name: PEER-TEST + ike_group: IKE-TEST + default_esp_group: ESP-TEST + remote_address: + - 203.0.113.1 + state: merged + + + +Return Values +------------- +Common return values are documented `here `_, the following are the fields unique to this module: + +.. raw:: html + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
KeyReturnedDescription
+
+ after + +
+ dictionary +
+ 		when changed +
The resulting configuration after module execution.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ before + +
+ dictionary +
+ 		when state is merged, replaced, overridden or deleted +
The configuration prior to the module execution.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ commands + +
+ list +
+ 		when state is merged, replaced, overridden or deleted +
The set of commands pushed to the remote device.
+
+
Sample:
+
["set vpn ipsec site-to-site peer PEER-TEST ike-group 'IKE-TEST'", "set vpn ipsec site-to-site peer PEER-TEST default-esp-group 'ESP-TEST'"]
+
+
+ gathered + +
+ dictionary +
+ 		when state is gathered +
Facts about the network resource gathered from the remote device as structured data.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ parsed + +
+ dictionary +
+ 		when state is parsed +
The device native config provided in running_config option parsed into structured data as per module argspec.
+
+
Sample:
+
This output will always be in the same format as the module argspec.
+
+
+ rendered + +
+ list +
+ 		when state is rendered +
The provided configuration in the task rendered in device-native format (offline).
+
+
Sample:
+
["set vpn ipsec site-to-site peer PEER-TEST ike-group 'IKE-TEST'"]
+
+

+ + +Status +------ + + +Authors +~~~~~~~ + +- Evgeny Molotkov (@omnom62) -- cgit v1.2.3