When we put this command we got an error like:
set interfaces tunnel tun100 local-ip '192.0.2.1'
Configuration path: interfaces tunnel tun100 [local-ip] is not valid
Set failed
To make easily understandable the Site-to-Site VPN ikev2 configuration for users (especially if the user is new to VyOS) made the following changes:
- Added dummy interface to both routers for testing purposes
- Added static route for both routers for dummy interface
- Added this line of command:
set vpn ipsec option disable-route-autoinstall
Because when we write this line after the commit action we got an error like:
WARNING: It's recommended to use ipsec vti with the next command
- corrected this line:
set vpn ipsec site-to-site peer OFFICE-B local-address '192.168.0.10'
to this:
set vpn ipsec site-to-site peer OFFICE-B local-address '172.18.201.10'
Based on the discussion here: https://forum.vyos.io/t/dynamic-dns-not-wollowing-web-options/12309 it seems necessary to note that setting the web-options on a given interface is not sufficient for determining the IP address when behind NAT.
I've added some additional detail, which I think will make that more clear, as well as listed the commands as required to set up DDNS behind NAT.
Further I updated the section on RFC2136 to accurately show address instead of interface
Updated command syntax for dynamic dns - changed set service dns dynamic interface to set service dns dynamic address.
Changed the login option from 'login' to 'username'
Changed the web options from 'use-web' to 'web-options'
Changed because I ran into the command syntax change on a 1.4 install. Updating documents to match.
1. In the new version of Libvirt this --os-type is deprecated. When we put this option we get this message "WARNING --os-type is deprecated and does nothing. Please stop using it."
2. Some ques OS KVM console is chosen as the default boot option and when we enter the console console hangs. For this reason, we need to reboot and select Serial console.
RADIUS and TACACS configuration examples were added.
Also mentioned if there is no connection between VyOS and RADIUS/TACACS servers users need to use local accounts for authentication.
