Page MenuHomeDevCentral

Configure strongSwan as IPsec implementation
Needs ReviewPublic

Authored by Duranzed on Mon, Mar 2, 19:29.
Tags
None
Referenced Files
F24881719: D3988.id10385.diff
Sun, Mar 15, 15:25
F24880671: D3988.id10401.diff
Sun, Mar 15, 13:39
F24880632: D3988.id10401.diff
Sun, Mar 15, 13:36
F24878308: D3988.id10400.diff
Sun, Mar 15, 09:33
F24878226: D3988.id10400.diff
Sun, Mar 15, 09:25
Unknown Object (File)
Sat, Mar 14, 19:37
Unknown Object (File)
Sat, Mar 14, 10:36
Unknown Object (File)
Sat, Mar 14, 02:57
Subscribers
None

Details

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
strongswan
Build Status
Buildable 6461
Build 6745: arc lint + arc unit

Event Timeline

Duranzed requested review of this revision.Mon, Mar 2, 19:29
Duranzed created this revision.
  • Added an init.sls pour strongswan

No link to a task in description?

dereckson retitled this revision from IPsec strongswan configuration to Configure strongSwan as IPsec implementation.Wed, Mar 4, 06:49
dereckson edited the summary of this revision. (Show Details)
dereckson requested changes to this revision.Wed, Mar 4, 07:14

Service part OK.

Configuration needs a better strategy to allow to provision per machine.

_modules/credentials.py
304

That's handled in D3987.

Perhaps you want to do an arc diff HEAD^ --update D3988 ?

pillar/core/network.sls
59

We can use the banner format here, to be coherent with the repository style.

74

You can provision them as a follow-up change, uncommented instead.

94

That comment can be safely removed: the pillar name and the ike_ esp_ keys make that clear what is it.

roles/core/strongswan/config.sls
22

Jinja syntax allows to use dots as separator to access dictionary keys.

We can use it, but in that case, it's really coherent to use it everywhere.

23

Won't really work beyond the scope of a test tunnel between those two links. You need a more flexible way to pass the info according the node.

Besides, if you deploy this on both router-002 and router-003 you would get twice the config router-002 to router-003 it seems.

roles/core/strongswan/files/swanctl.conf
2
roles/core/strongswan/init.sls
2

Header missing

5

That one doesn't exist in the change it seems

This revision now requires changes to proceed.Wed, Mar 4, 07:14

Updated strongswan config files and using a for loop for a more readable code

Duranzed marked 4 inline comments as done.

Modified Ysul IP adress in network.sls

Updated config files to use node.resolve_gre_tunnels

Improved configuration files and headers

Added software.sls and modified init.sls

dereckson requested changes to this revision.Thu, Mar 12, 21:59
dereckson added inline comments.
roles/core/strongswan/files/swanctl.conf
50
This revision now requires changes to proceed.Thu, Mar 12, 21:59

Test to deploy this final version on Complector with a test=True to see if it's still no-op.

  • Modified to create tunnels from router-003
  • Roles: update network pillar