A feature request was made with a change in behavior:
https://phabricator.vyos.net/T4005
(Feature Request: IPsec IKEv1 + IKEv2 for one peer)
- Feed Queries
- All Stories
- Search
- Feed Search
- Transactions
- Transaction Logs
All Stories
Nov 20 2021
pool request:
https://github.com/vyos/vyatta-cfg-vpn/pull/51
Create an Ike-group without a command "key-exchange" (like in VyOS 1.4):
I think this is what it would look like in service dhcp server. I left some comments to explain my thinking a bit, and I tried to make it as flexible as possible (for example the way match options are strings, so future DHCP options can be supported as soon as ISC supports them):
failover {
name INT
remote 192.168.15.4
source-address 192.168.15.3
status primary
}
shared-network-name INT {
description "Internal connection to ir01"
class CLIENT_MAP {
rule 10 {
action permit # This is equivalent to dhcpd's allow/deny members of
match option "agent.circuit_id" value "Vlan200" # This could match any option (ex: dhcp-client-identifier)
}
}
class GUEST_MAP {
rule 10 {
action permit
match option "agent.circuit_id" value "Vlan240"
}
}
subnet 192.168.1.0/24 {
class CLIENT_MAP
default-router 192.168.1.1
domain-name int.trae32566.org
domain-search int.trae32566.org
domain-search ipa.trae32566.org
domain-search trae32566.org
enable-failover
name-server 192.168.255.1
name-server 192.168.15.10
name-server 192.168.31.3
ntp-server 192.168.255.2
ntp-server 192.168.15.11
ntp-server 192.168.31.4
range CLIENTS {
start 192.168.1.2
stop 192.168.1.240
}
server-identifier 192.168.15.2
static-mapping QUEST {
ip-address 192.168.1.17
mac-address 80:f3:ef:11:e7:e7
}
}
subnet 192.168.6.0/24 {
class GUEST_MAP
default-router 192.168.6.1
enable-failover
name-server 1.1.1.1
name-server 1.0.0.1
name-server 8.8.8.8
ntp-server 50.205.57.38
ntp-server 64.225.34.103
ntp-server 129.250.35.251
server-identifier 192.168.15.2
range GUESTS {
start 192.168.6.2
stop 192.168.6.254
}
}
subnet 192.168.15.0/29 { # This tells it indirectly to use the interface eth2, which is on this subnet (is there a better way?)
default-router 192.168.15.1
enable-failover
range DUMMY {
start 192.168.15.2
stop 192.168.15.7
}
}
}Nov 19 2021
I would not call this a bug as this is produced on intention.
Submitted this PR: https://github.com/vyos/vyos-1x/pull/1075
I wish I understood this subsystem better as I'd love to get it fixed. I'm going to take a closer look tomorrow
Nov 18 2021
One detail towards a resolution: if the vyos-http-api-server is started manually (without systemd) then the output is not truncated. If one wants to try this, one should configure 'set service https api' (to update Nginx config appropriately); then 'systemctl stop vyos-http-api'; then, as root:
Shows which options moved to the new name in swanctl
Re-tested working on
Thanks, I've confirmed the issue; I should have it resolved soon
I notice my example of the API only focused on one interface (eth0), where the CLI (and the title showed all interfaces). Doesn't change the fact that in either case the API doesn't return data for the description.
I don't think that it is a bug.
If you don't set any value, it gets default value ikev1
https://github.com/vyos/vyatta-cfg-vpn/blob/d2d4361bffaa0b99c85c7fbf46ddd760ae6512f0/templates/vpn/ipsec/ike-group/node.tag/key-exchange/node.def#L3
Nov 17 2021
Since we had to revert to the old NAT implementation due to kernel issues, this had to be back-back-ported to the old Perl code as well.