vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Change IPsec authentication PSK and examples

Browse Source
This commit is contained in:
Viacheslav Hletenko 2023-02-05 12:22:36 +00:00
parent d39ce49e2f
commit 8f61920f01
7 changed files with 112 additions and 71 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
docs/configexamples/azure-vpn-bgp.rst
View File

@ -100,15 +100,18 @@ Vyos configuration
.. code-block:: none .. code-block:: none
set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3' set vpn ipsec authentication psk azure id '198.51.100.3'
set vpn ipsec authentication psk azure id '203.0.113.2'
set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond' set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL' set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE' set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit' set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5' set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
set vpn ipsec site-to-site peer azure remote-address '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1' set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE' set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'

49
docs/configexamples/azure-vpn-dual-bgp.rst
View File

@ -103,29 +103,34 @@ Vyos configuration
.. code-block:: none .. code-block:: none
set vpn ipsec site-to-site peer 203.0.113.2 authentication id '198.51.100.3' set vpn ipsec authentication psk azure id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret' set vpn ipsec authentication psk azure id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.2 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk' set vpn ipsec authentication psk azure id '203.0.113.3'
set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2' set vpn ipsec authentication psk azure secret 'ch00s3-4-s3cur3-psk'
set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.2 local-address '10.10.0.5'
set vpn ipsec site-to-site peer 203.0.113.2 vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.2 vti esp-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.3 authentication id '198.51.100.3' set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer 203.0.113.3 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 203.0.113.3 authentication pre-shared-secret 'ch00s3-4-s3cur3-psk' set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.3 authentication remote-id '203.0.113.3' set vpn ipsec site-to-site peer azure-primary connection-type 'respond'
set vpn ipsec site-to-site peer 203.0.113.3 connection-type 'respond' set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
set vpn ipsec site-to-site peer 203.0.113.3 description 'AZURE SECONDARY TUNNEL' set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
set vpn ipsec site-to-site peer 203.0.113.3 ike-group 'AZURE' set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 203.0.113.3 ikev2-reauth 'inherit' set vpn ipsec site-to-site peer azure-primary local-address '10.10.0.5'
set vpn ipsec site-to-site peer 203.0.113.3 local-address '10.10.0.5' set vpn ipsec site-to-site peer azure-primary remote-address '203.0.113.2'
set vpn ipsec site-to-site peer 203.0.113.3 vti bind 'vti2' set vpn ipsec site-to-site peer azure-primary vti bind 'vti1'
set vpn ipsec site-to-site peer 203.0.113.3 vti esp-group 'AZURE' set vpn ipsec site-to-site peer azure-primary vti esp-group 'AZURE'
set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
set vpn ipsec site-to-site peer azure-secondary connection-type 'respond'
set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer azure-secondary local-address '10.10.0.5'
set vpn ipsec site-to-site peer azure-secondary remote-address '203.0.113.3'
set vpn ipsec site-to-site peer azure-secondary vti bind 'vti2'
set vpn ipsec site-to-site peer azure-secondary vti esp-group 'AZURE'
- **Important**: Add an interface route to reach both Azure's BGP listeners - **Important**: Add an interface route to reach both Azure's BGP listeners

21
docs/configuration/interfaces/l2tpv3.rst
View File

@ -141,29 +141,26 @@ IPSec:
.. code-block:: none .. code-block:: none
set vpn ipsec authentication psk <pre-shared-name> id '%any'
set vpn ipsec authentication psk <pre-shared-name> secret <pre-shared-key>
set vpn ipsec interface <VPN-interface> set vpn ipsec interface <VPN-interface>
set vpn ipsec esp-group test-ESP-1 compression 'disable'
set vpn ipsec esp-group test-ESP-1 lifetime '3600' set vpn ipsec esp-group test-ESP-1 lifetime '3600'
set vpn ipsec esp-group test-ESP-1 mode 'transport' set vpn ipsec esp-group test-ESP-1 mode 'transport'
set vpn ipsec esp-group test-ESP-1 pfs 'enable' set vpn ipsec esp-group test-ESP-1 pfs 'enable'
set vpn ipsec esp-group test-ESP-1 proposal 1 encryption 'aes128' set vpn ipsec esp-group test-ESP-1 proposal 1 encryption 'aes128'
set vpn ipsec esp-group test-ESP-1 proposal 1 hash 'sha1' set vpn ipsec esp-group test-ESP-1 proposal 1 hash 'sha1'
set vpn ipsec ike-group test-IKE-1 ikev2-reauth 'no'
set vpn ipsec ike-group test-IKE-1 key-exchange 'ikev1' set vpn ipsec ike-group test-IKE-1 key-exchange 'ikev1'
set vpn ipsec ike-group test-IKE-1 lifetime '3600' set vpn ipsec ike-group test-IKE-1 lifetime '3600'
set vpn ipsec ike-group test-IKE-1 proposal 1 dh-group '5' set vpn ipsec ike-group test-IKE-1 proposal 1 dh-group '5'
set vpn ipsec ike-group test-IKE-1 proposal 1 encryption 'aes128' set vpn ipsec ike-group test-IKE-1 proposal 1 encryption 'aes128'
set vpn ipsec ike-group test-IKE-1 proposal 1 hash 'sha1' set vpn ipsec ike-group test-IKE-1 proposal 1 hash 'sha1'
set vpn ipsec site-to-site peer <peer-ip> authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer <connection-name> authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer <peer-ip> authentication pre-shared-secret <pre-shared-key> set vpn ipsec site-to-site peer <connection-name> connection-type 'initiate'
set vpn ipsec site-to-site peer <peer-ip> connection-type 'initiate' set vpn ipsec site-to-site peer <connection-name> ike-group 'test-IKE-1'
set vpn ipsec site-to-site peer <peer-ip> ike-group 'test-IKE-1' set vpn ipsec site-to-site peer <connection-name> ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer <peer-ip> ikev2-reauth 'inherit' set vpn ipsec site-to-site peer <connection-name> local-address <local-ip>
set vpn ipsec site-to-site peer <peer-ip> local-address <local-ip> set vpn ipsec site-to-site peer <connection-name> tunnel 1 esp-group 'test-ESP-1'
set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-nat-networks 'disable' set vpn ipsec site-to-site peer <connection-name> tunnel 1 protocol 'l2tp'
set vpn ipsec site-to-site peer <peer-ip> tunnel 1 allow-public-networks 'disable'
set vpn ipsec site-to-site peer <peer-ip> tunnel 1 esp-group 'test-ESP-1'
set vpn ipsec site-to-site peer <peer-ip> tunnel 1 protocol 'l2tp'
Bridge: Bridge:

27
docs/configuration/nat/nat44.rst
View File

@ -697,17 +697,22 @@ too.
.. code-block:: none .. code-block:: none
set vpn ipsec site-to-site peer 198.51.100.243 authentication mode 'pre-shared-secret' set vpn ipsec authentication psk vyos id '203.0.113.46'
set vpn ipsec site-to-site peer 198.51.100.243 authentication pre-shared-secret 'PASSWORD IS HERE' set vpn ipsec authentication psk vyos id '198.51.100.243'
set vpn ipsec site-to-site peer 198.51.100.243 connection-type 'initiate' set vpn ipsec authentication psk vyos secret 'MYSECRETPASSWORD'
set vpn ipsec site-to-site peer 198.51.100.243 default-esp-group 'my-esp' set vpn ipsec site-to-site peer branch authentication local-id '203.0.113.46'
set vpn ipsec site-to-site peer 198.51.100.243 ike-group 'my-ike' set vpn ipsec site-to-site peer branch authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 198.51.100.243 ikev2-reauth 'inherit' set vpn ipsec site-to-site peer branch authentication remote-id '198.51.100.243'
set vpn ipsec site-to-site peer 198.51.100.243 local-address '203.0.113.46' set vpn ipsec site-to-site peer branch connection-type 'initiate'
set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 local prefix '172.29.41.89/32' set vpn ipsec site-to-site peer branch default-esp-group 'my-esp'
set vpn ipsec site-to-site peer 198.51.100.243 tunnel 0 remote prefix '172.27.1.0/24' set vpn ipsec site-to-site peer branch ike-group 'my-ike'
set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 local prefix '172.29.41.89/32' set vpn ipsec site-to-site peer branch ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 198.51.100.243 tunnel 1 remote prefix '10.125.0.0/16' set vpn ipsec site-to-site peer branch local-address '203.0.113.46'
set vpn ipsec site-to-site peer branch remote-address '198.51.100.243'
set vpn ipsec site-to-site peer branch tunnel 0 local prefix '172.29.41.89/32'
set vpn ipsec site-to-site peer branch tunnel 0 remote prefix '172.27.1.0/24'
set vpn ipsec site-to-site peer branch tunnel 1 local prefix '172.29.41.89/32'
set vpn ipsec site-to-site peer branch tunnel 1 remote prefix '10.125.0.0/16'
Testing and Validation Testing and Validation
"""""""""""""""""""""" """"""""""""""""""""""

39
docs/configuration/system/acceleration.rst
View File

@ -63,39 +63,50 @@ Side A:
.. code-block:: .. code-block::
set interfaces vti vti1 address '192.168.1.2/24' set interfaces vti vti1 address '192.168.1.2/24'
set vpn ipsec authentication psk right id '10.10.10.2'
set vpn ipsec authentication psk right id '10.10.10.1'
set vpn ipsec authentication psk right secret 'Qwerty123'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256' set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256' set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14' set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256' set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256' set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0' set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer 10.10.10.1 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer right authentication local-id '10.10.10.2'
set vpn ipsec site-to-site peer 10.10.10.1 authentication pre-shared-secret 'Qwerty123' set vpn ipsec site-to-site peer right authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 10.10.10.1 connection-type 'initiate' set vpn ipsec site-to-site peer right authentication remote-id '10.10.10.1'
set vpn ipsec site-to-site peer 10.10.10.1 default-esp-group 'MyESPGroup' set vpn ipsec site-to-site peer right connection-type 'initiate'
set vpn ipsec site-to-site peer 10.10.10.1 ike-group 'MyIKEGroup' set vpn ipsec site-to-site peer right default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer 10.10.10.1 local-address '10.10.10.2' set vpn ipsec site-to-site peer right ike-group 'MyIKEGroup'
set vpn ipsec site-to-site peer 10.10.10.1 vti bind 'vti1' set vpn ipsec site-to-site peer right local-address '10.10.10.2'
set vpn ipsec site-to-site peer right remote-address '10.10.10.1'
set vpn ipsec site-to-site peer right vti bind 'vti1'
Side B: Side B:
.. code-block:: .. code-block::
set interfaces vti vti1 address '192.168.1.1/24' set interfaces vti vti1 address '192.168.1.1/24'
set vpn ipsec authentication psk left id '10.10.10.2'
set vpn ipsec authentication psk left id '10.10.10.1'
set vpn ipsec authentication psk left secret 'Qwerty123'
set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256' set vpn ipsec esp-group MyESPGroup proposal 1 encryption 'aes256'
set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256' set vpn ipsec esp-group MyESPGroup proposal 1 hash 'sha256'
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14' set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '14'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256' set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes256'
set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256' set vpn ipsec ike-group MyIKEGroup proposal 1 hash 'sha256'
set vpn ipsec interface 'eth0' set vpn ipsec interface 'eth0'
set vpn ipsec site-to-site peer 10.10.10.2 authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer left authentication local-id '10.10.10.1'
set vpn ipsec site-to-site peer 10.10.10.2 authentication pre-shared-secret 'Qwerty123' set vpn ipsec site-to-site peer left authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 10.10.10.2 connection-type 'initiate' set vpn ipsec site-to-site peer left authentication remote-id '10.10.10.2'
set vpn ipsec site-to-site peer 10.10.10.2 default-esp-group 'MyESPGroup' set vpn ipsec site-to-site peer left connection-type 'initiate'
set vpn ipsec site-to-site peer 10.10.10.2 ike-group 'MyIKEGroup' set vpn ipsec site-to-site peer left default-esp-group 'MyESPGroup'
set vpn ipsec site-to-site peer 10.10.10.2 local-address '10.10.10.1' set vpn ipsec site-to-site peer left ike-group 'MyIKEGroup'
set vpn ipsec site-to-site peer 10.10.10.2 vti bind 'vti1' set vpn ipsec site-to-site peer left local-address '10.10.10.1'
set vpn ipsec site-to-site peer left remote-address '10.10.10.2'
set vpn ipsec site-to-site peer left vti bind 'vti1'
a bandwidth test over the VPN got these results: a bandwidth test over the VPN got these results:

6
docs/configuration/vpn/ipsec.rst
View File

@ -202,6 +202,11 @@ On the LEFT:
## IPsec ## IPsec
set vpn ipsec interface eth0 set vpn ipsec interface eth0
# Pre-shared-secret
set vpn ipsec authentication psk vyos id 192.0.2.10
set vpn ipsec authentication psk vyos id 203.0.113.45
set vpn ipsec authentication psk vyos secret MYSECRETKEY
# IKE group # IKE group
set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2' set vpn ipsec ike-group MyIKEGroup proposal 1 dh-group '2'
set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128' set vpn ipsec ike-group MyIKEGroup proposal 1 encryption 'aes128'
@ -213,7 +218,6 @@ On the LEFT:
# IPsec tunnel # IPsec tunnel
set vpn ipsec site-to-site peer right authentication mode pre-shared-secret set vpn ipsec site-to-site peer right authentication mode pre-shared-secret
set vpn ipsec site-to-site peer right authentication pre-shared-secret MYSECRETKEY
set vpn ipsec site-to-site peer right authentication remote-id 203.0.113.45 set vpn ipsec site-to-site peer right authentication remote-id 203.0.113.45
set vpn ipsec site-to-site peer right ike-group MyIKEGroup set vpn ipsec site-to-site peer right ike-group MyIKEGroup

34
docs/configuration/vpn/site2site_ipsec.rst
View File

@ -18,23 +18,29 @@ Each site-to-site peer has the next options:
* ``authentication`` - configure authentication between VyOS and a remote peer. * ``authentication`` - configure authentication between VyOS and a remote peer.
Suboptions: Suboptions:
* ``psk`` - Preshared secret key name:
* ``dhcp-interface`` - ID for authentication generated from DHCP address
dynamically;
* ``id`` - static ID's for authentication. In general local and remote
address ``<x.x.x.x>``, ``<h:h:h:h:h:h:h:h>`` or ``%any``;
* ``secret`` - predefined shared secret. Used if configured mode
``pre-shared-secret``;
* ``local-id`` - ID for the local VyOS router. If defined, during the * ``local-id`` - ID for the local VyOS router. If defined, during the
authentication authentication
it will be send to remote peer; it will be send to remote peer;
* ``mode`` - mode for authentication between VyOS and remote peer: * ``mode`` - mode for authentication between VyOS and remote peer:
* ``pre-shared-secret`` - use predefined shared secret phrase, must be the * ``pre-shared-secret`` - use predefined shared secret phrase;
same for local and remote side;
* ``rsa`` - use simple shared RSA key. The key must be defined in the * ``rsa`` - use simple shared RSA key. The key must be defined in the
``set vpn rsa-keys`` section; ``set vpn rsa-keys`` section;
* ``x509`` - use certificates infrastructure for authentication. * ``x509`` - use certificates infrastructure for authentication.
* ``pre-shared-secret`` - predefined shared secret. Used if configured
``mode pre-shared-secret``;
* ``remote-id`` - define an ID for remote peer, instead of using peer name or * ``remote-id`` - define an ID for remote peer, instead of using peer name or
address. Useful in case if the remote peer is behind NAT or if ``mode x509`` address. Useful in case if the remote peer is behind NAT or if ``mode x509``
is used; is used;
@ -161,6 +167,9 @@ Example:
.. code-block:: none .. code-block:: none
# server config # server config
set vpn ipsec authentication psk OFFICE-B id '198.51.100.3'
set vpn ipsec authentication psk OFFICE-B id '203.0.113.2'
set vpn ipsec authentication psk OFFICE-B secret 'SomePreSharedKey'
set vpn ipsec esp-group office-srv-esp lifetime '1800' set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel' set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable' set vpn ipsec esp-group office-srv-esp pfs 'enable'
@ -171,8 +180,8 @@ Example:
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256' set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1' set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1' set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-B authentication local-id '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-B authentication pre-shared-secret 'SomePreSharedKey'
set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '203.0.113.2' set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-B ike-group 'office-srv-ike' set vpn ipsec site-to-site peer OFFICE-B ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer OFFICE-B local-address '198.51.100.3' set vpn ipsec site-to-site peer OFFICE-B local-address '198.51.100.3'
@ -182,6 +191,9 @@ Example:
set vpn ipsec site-to-site peer OFFICE-B tunnel 0 remote prefix '10.0.0.0/21' set vpn ipsec site-to-site peer OFFICE-B tunnel 0 remote prefix '10.0.0.0/21'
# remote office config # remote office config
set vpn ipsec authentication psk OFFICE-A id '198.51.100.3'
set vpn ipsec authentication psk OFFICE-A id '203.0.113.2'
set vpn ipsec authentication psk OFFICE-A secret 'SomePreSharedKey'
set vpn ipsec esp-group office-srv-esp lifetime '1800' set vpn ipsec esp-group office-srv-esp lifetime '1800'
set vpn ipsec esp-group office-srv-esp mode 'tunnel' set vpn ipsec esp-group office-srv-esp mode 'tunnel'
set vpn ipsec esp-group office-srv-esp pfs 'enable' set vpn ipsec esp-group office-srv-esp pfs 'enable'
@ -192,8 +204,8 @@ Example:
set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256' set vpn ipsec ike-group office-srv-ike proposal 1 encryption 'aes256'
set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1' set vpn ipsec ike-group office-srv-ike proposal 1 hash 'sha1'
set vpn ipsec interface 'eth1' set vpn ipsec interface 'eth1'
set vpn ipsec site-to-site peer OFFICE-A authentication local-id '203.0.113.2'
set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-A authentication pre-shared-secret 'SomePreSharedKey'
set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '198.51.100.3' set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '198.51.100.3'
set vpn ipsec site-to-site peer OFFICE-A ike-group 'office-srv-ike' set vpn ipsec site-to-site peer OFFICE-A ike-group 'office-srv-ike'
set vpn ipsec site-to-site peer OFFICE-A local-address '203.0.113.2' set vpn ipsec site-to-site peer OFFICE-A local-address '203.0.113.2'
@ -279,6 +291,9 @@ Imagine the following topology
set interfaces vti vti10 address '10.0.0.2/31' set interfaces vti vti10 address '10.0.0.2/31'
set vpn ipsec authentication psk OFFICE-B id '172.18.201.10'
set vpn ipsec authentication psk OFFICE-B id '172.18.202.10'
set vpn ipsec authentication psk OFFICE-B secret 'secretkey'
set vpn ipsec esp-group ESP_DEFAULT lifetime '3600' set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel' set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19' set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
@ -293,7 +308,6 @@ Imagine the following topology
set vpn ipsec interface 'eth0.201' set vpn ipsec interface 'eth0.201'
set vpn ipsec site-to-site peer OFFICE-B authentication local-id '172.18.201.10' set vpn ipsec site-to-site peer OFFICE-B authentication local-id '172.18.201.10'
set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer OFFICE-B authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-B authentication pre-shared-secret 'secretkey'
set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '172.18.202.10' set vpn ipsec site-to-site peer OFFICE-B authentication remote-id '172.18.202.10'
set vpn ipsec site-to-site peer OFFICE-B connection-type 'respond' set vpn ipsec site-to-site peer OFFICE-B connection-type 'respond'
set vpn ipsec site-to-site peer OFFICE-B ike-group 'IKEv2_DEFAULT' set vpn ipsec site-to-site peer OFFICE-B ike-group 'IKEv2_DEFAULT'
@ -308,6 +322,9 @@ Imagine the following topology
set interfaces vti vti10 address '10.0.0.3/31' set interfaces vti vti10 address '10.0.0.3/31'
set vpn ipsec authentication psk OFFICE-A id '172.18.201.10'
set vpn ipsec authentication psk OFFICE-A id '172.18.202.10'
set vpn ipsec authentication psk OFFICE-A secret 'secretkey'
set vpn ipsec esp-group ESP_DEFAULT lifetime '3600' set vpn ipsec esp-group ESP_DEFAULT lifetime '3600'
set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel' set vpn ipsec esp-group ESP_DEFAULT mode 'tunnel'
set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19' set vpn ipsec esp-group ESP_DEFAULT pfs 'dh-group19'
@ -325,7 +342,6 @@ Imagine the following topology
set vpn ipsec interface 'eth0.202' set vpn ipsec interface 'eth0.202'
set vpn ipsec site-to-site peer OFFICE-A authentication local-id '172.18.202.10' set vpn ipsec site-to-site peer OFFICE-A authentication local-id '172.18.202.10'
set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret' set vpn ipsec site-to-site peer OFFICE-A authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer OFFICE-A authentication pre-shared-secret 'secretkey'
set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '172.18.201.10' set vpn ipsec site-to-site peer OFFICE-A authentication remote-id '172.18.201.10'
set vpn ipsec site-to-site peer OFFICE-A connection-type 'initiate' set vpn ipsec site-to-site peer OFFICE-A connection-type 'initiate'
set vpn ipsec site-to-site peer OFFICE-A ike-group 'IKEv2_DEFAULT' set vpn ipsec site-to-site peer OFFICE-A ike-group 'IKEv2_DEFAULT'