vyos-1x/data/templates/ipsec/swanctl/profile.j2 at ab9cb39db44b2257115bfbe287971d702c2e7ebc · vyos/vyos-1x · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
{% macro conn(name, profile_conf, ike_group, esp_group, uniqreqids) %}
{# peer needs to reference the global IKE configuration for certain values #}
{% set ike = ike_group[profile_conf.ike_group] %}
{% set esp = esp_group[profile_conf.esp_group] %}
{% if profile_conf.bind.tunnel is vyos_defined %}
{%     for interface in profile_conf.bind.tunnel %}
    dmvpn-{{ name }}-{{ interface }} {
        proposals = {{ ike_group[profile_conf.ike_group] | get_esp_ike_cipher(esn=False) | join(',') }}
        version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }}
        rekey_time = {{ ike.lifetime }}s
        keyingtries = 0
{%         if ike.dead_peer_detection is vyos_defined %}
        dpd_timeout = {{ ike.dead_peer_detection.timeout }}
        dpd_delay = {{ ike.dead_peer_detection.interval }}
{%         endif %}
{%         if uniqreqids is vyos_defined %}
        unique = {{ uniqreqids }}
{%         endif %}
{%         if profile_conf.authentication.mode is vyos_defined('pre-shared-secret') %}
        local {
            auth = psk
        }
        remote {
            auth = psk
        }
{%         endif %}
        children {
            dmvpn-{{ name }}-{{ interface }}-child {
                esp_proposals = {{ esp | get_esp_ike_cipher(ike) | join(',') }}
                rekey_time = {{ esp.lifetime }}s
                rand_time = 540s
                local_ts = dynamic[gre]
                remote_ts = dynamic[gre]
                mode = {{ esp.mode }}
                dpd_action = clear
                close_action = none
                start_action = none
{%         if esp.compression is vyos_defined('enable') %}
                ipcomp = yes
{%         endif %}
            }
        }
    }
{%     endfor %}
{% endif %}
{% endmacro %}