{#

#

# Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.

#

# Licensed under the Apache License, Version 2.0 (the "License"); you may

# not use this file except in compliance with the License. You may obtain

# a copy of the License at

#

# http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the

# License for the specific language governing permissions and limitations

# under the License.

#

#}

# IKE Configuration for vpn-service "{{vpnservice.id}}"

# Configuration for vpn-service "{{vpnservice.id}}"

{% for ipsec_site_connection in vpnservice.ipsec_site_connections if ipsec_site_connection.admin_state_up

%}

{% set aalg=ipsec_site_connection.ipsecpolicy.auth_algorithm %}

{% set ealg=ipsec_site_connection.ipsecpolicy.encryption_algorithm %}

{% set tun_name=ipsec_site_connection['tunnel_id'] %}

{% if ipsec_site_connection.ipsecpolicy.transform_protocol == "esp" %}

{% set atok="encr_auth_algs" %}

{% else %}

{% set atok="auth_algs" %}

{% endif %}

{% if ipsec_site_connection.ipsecpolicy.transform_protocol == "ah" %}

{% set etok="" %}

{% set ealg="" %}

{% else %}

{% set etok="encr_algs" %}

{% endif %}

{% set laddr=vpnservice.subnet.cidr %}

{% set raddr=ipsec_site_connection['peer_cidrs']|join(' ') %}

{# We can support Combined modes algorithms by configuring the authentication

# and encryption algorithms as the same value.

#}

{% if aalg == ealg %}

{% set atok="" %}

{% set aalg="" %}

{% endif %}

{ tunnel {{tun_name}} negotiate tunnel laddr {{laddr}} raddr {{raddr}} } ipsec

{ {{atok}} {{aalg}} {{etok}} {{ealg}} sa shared }

{% endfor %}