vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update site2site_ipsec.rst

Browse Source 
To make easily understandable the Site-to-Site VPN ikev2 configuration for users (specially if the user is new in VyOS) made the following changes:
- Added dummy interface to both routers for testing purposes
- Added static route for both routers for dummy interface
This commit is contained in:
aslanvyos 2023-10-18 12:14:46 +04:00 committed by GitHub
parent ce71650a4d
commit 02e462900f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 21 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
docs/configuration/vpn/site2site_ipsec.rst
View File

@ -272,15 +272,28 @@ Imagine the following topology
IPSec IKEv2 site2site VPN (source ./draw.io/vpn_s2s_ikev2.drawio)
**LEFT:**
* WAN interface on `eth0.201`
* `eth0.201` interface IP: `172.18.201.10/24`
* `vti10` interface IP: `10.0.0.2/31`
* `dum0` interface IP: `10.0.11.1/24` (for testing purposes we create the `dummy` interface)
**RIGHT:**
* WAN interface on `eth0.202`
* `eth0.201` interface IP: `172.18.202.10/24`
* `vti10` interface IP: `10.0.0.3/31`
* `dum0` interface IP: `10.0.12.1/24` (for testing purposes we create the `dummy` interface)
.. note:: Don't get confused about the used /31 tunnel subnet. :rfc:`3021`
gives you additional information for using /31 subnets on point-to-point
links.
**left**
**LEFT**
.. code-block:: none
set interfaces ethernet eth0 vif 201 address '172.18.201.10/24'
set interfaces dummy dum0 address '10.0.11.1/24'
set interfaces vti vti10 address '10.0.0.2/31'
set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
@ -311,10 +324,14 @@ Imagine the following topology
set vpn ipsec site-to-site peer 172.18.202.10 vti bind 'vti10'
set vpn ipsec site-to-site peer 172.18.202.10 vti esp-group 'ESP_DEFAULT'
**right**
set protocols static interface-route 10.0.12.0/24 next-hop-interface vti10
**RIGHT**
.. code-block:: none
set interfaces ethernet eth0 vif 202 address '172.18.202.10/24'
set interfaces dummy dum0 address '10.0.12.1/24'
set interfaces vti vti10 address '10.0.0.3/31'
set vpn ipsec esp-group ESP_DEFAULT compression 'disable'
@ -345,6 +362,8 @@ Imagine the following topology
set vpn ipsec site-to-site peer 172.18.201.10 vti bind 'vti10'
set vpn ipsec site-to-site peer 172.18.201.10 vti esp-group 'ESP_DEFAULT'
set protocols static interface-route 10.0.11.0/24 next-hop-interface vti10
Key Parameters:
* ``authentication local-id/remote-id`` - IKE identification is used for