Page MenuHomeDevCentral

Configure strongSwan as IPsec implementation
Needs ReviewPublic

Authored by Duranzed on Mon, Mar 2, 19:29.
Tags
None
Referenced Files
F24925831: D3988.id10426.diff
Wed, Mar 18, 23:58
F24923292: D3988.id10401.diff
Wed, Mar 18, 18:45
F24922085: D3988.id10385.diff
Wed, Mar 18, 16:04
F24922050: D3988.id10426.diff
Wed, Mar 18, 16:04
F24922043: D3988.id10425.diff
Wed, Mar 18, 16:04
F24922040: D3988.id10427.diff
Wed, Mar 18, 16:04
F24922033: D3988.id10382.diff
Wed, Mar 18, 16:04
F24922024: D3988.id10400.diff
Wed, Mar 18, 16:04
Subscribers
None

Details

Diff Detail

Repository
rOPS Nasqueron Operations
Lint
Lint Passed
Unit
No Test Coverage
Branch
GRE-tunnel
Build Status
Buildable 6491
Build 6775: arc lint + arc unit

Event Timeline

Duranzed requested review of this revision.Mon, Mar 2, 19:29
Duranzed created this revision.
  • Added an init.sls pour strongswan

No link to a task in description?

dereckson retitled this revision from IPsec strongswan configuration to Configure strongSwan as IPsec implementation.Wed, Mar 4, 06:49
dereckson edited the summary of this revision. (Show Details)
dereckson requested changes to this revision.Wed, Mar 4, 07:14

Service part OK.

Configuration needs a better strategy to allow to provision per machine.

_modules/credentials.py
304 ↗(On Diff #10353)

That's handled in D3987.

Perhaps you want to do an arc diff HEAD^ --update D3988 ?

pillar/core/network.sls
58 ↗(On Diff #10353)

We can use the banner format here, to be coherent with the repository style.

73 ↗(On Diff #10353)

You can provision them as a follow-up change, uncommented instead.

93 ↗(On Diff #10353)

That comment can be safely removed: the pillar name and the ike_ esp_ keys make that clear what is it.

roles/core/strongswan/config.sls
21 ↗(On Diff #10353)

Jinja syntax allows to use dots as separator to access dictionary keys.

We can use it, but in that case, it's really coherent to use it everywhere.

22 ↗(On Diff #10353)

Won't really work beyond the scope of a test tunnel between those two links. You need a more flexible way to pass the info according the node.

Besides, if you deploy this on both router-002 and router-003 you would get twice the config router-002 to router-003 it seems.

roles/core/strongswan/files/swanctl.conf
1 ↗(On Diff #10353)
roles/core/strongswan/init.sls
1 ↗(On Diff #10353)

Header missing

4 ↗(On Diff #10353)

That one doesn't exist in the change it seems

This revision now requires changes to proceed.Wed, Mar 4, 07:14

Updated strongswan config files and using a for loop for a more readable code

Duranzed marked 4 inline comments as done.

Modified Ysul IP adress in network.sls

Updated config files to use node.resolve_gre_tunnels

Improved configuration files and headers

Added software.sls and modified init.sls

dereckson requested changes to this revision.Thu, Mar 12, 21:59
dereckson added inline comments.
roles/core/strongswan/files/swanctl.conf
50 ↗(On Diff #10401)
This revision now requires changes to proceed.Thu, Mar 12, 21:59

Test to deploy this final version on Complector with a test=True to see if it's still no-op.

  • Modified to create tunnels from router-003
  • Roles: update network pillar

using for loop to create GRE tunnel on router-002 and 003

Added IP canonical IP addresses to router-002 and router-003