Page MenuHomeDevCentral

Configure strongSwan as IPsec implementation
Needs RevisionPublic

Authored by Duranzed on Mon, Mar 2, 19:29.
Tags
None
Referenced Files
F24678376: D3988.diff
Wed, Mar 4, 18:52
F24674023: D3988.id10353.diff
Wed, Mar 4, 13:38
F24672246: D3988.id10342.diff
Wed, Mar 4, 11:40
F24670320: D3988.diff
Wed, Mar 4, 09:05
F24669770: D3988.id10353.diff
Wed, Mar 4, 08:27
F24668143: D3988.diff
Wed, Mar 4, 06:14
F24667202: D3988.id10342.diff
Wed, Mar 4, 05:16
F24665878: D3988.id10353.diff
Wed, Mar 4, 03:24
Subscribers
None

Details

Reviewers
dereckson

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
strongswan
Build Status
Buildable 6401
Build 6685: arc lint + arc unit

Event Timeline

Duranzed requested review of this revision.Mon, Mar 2, 19:29
Duranzed created this revision.
  • Added an init.sls pour strongswan

No link to a task in description?

dereckson retitled this revision from IPsec strongswan configuration to Configure strongSwan as IPsec implementation.Wed, Mar 4, 06:49
dereckson edited the summary of this revision. (Show Details)
dereckson requested changes to this revision.Wed, Mar 4, 07:14

Service part OK.

Configuration needs a better strategy to allow to provision per machine.

_modules/credentials.py
304

That's handled in D3987.

Perhaps you want to do an arc diff HEAD^ --update D3988 ?

pillar/core/network.sls
58

We can use the banner format here, to be coherent with the repository style.

73

You can provision them as a follow-up change, uncommented instead.

93

That comment can be safely removed: the pillar name and the ike_ esp_ keys make that clear what is it.

roles/core/strongswan/config.sls
21

Jinja syntax allows to use dots as separator to access dictionary keys.

We can use it, but in that case, it's really coherent to use it everywhere.

22

Won't really work beyond the scope of a test tunnel between those two links. You need a more flexible way to pass the info according the node.

Besides, if you deploy this on both router-002 and router-003 you would get twice the config router-002 to router-003 it seems.

roles/core/strongswan/files/swanctl.conf
1
roles/core/strongswan/init.sls
1

Header missing

4

That one doesn't exist in the change it seems

This revision now requires changes to proceed.Wed, Mar 4, 07:14