vici: Make IKEv2 the default IKE version

We don't want to accept IKEv1 clients anymore by default, so we also
warn them about it in the log.
This commit is contained in:
Tobias Brunner
2026-07-31 16:07:52 +02:00
parent e0fd0f51ea
commit bf438cb182
4 changed files with 16 additions and 6 deletions
+9 -1
View File
@@ -2804,7 +2804,7 @@ CALLBACK(config_sn, bool,
.send_certreq = TRUE,
.send_cert = CERT_SEND_IF_ASKED,
.ocsp = OCSP_SEND_REPLY,
.version = IKE_ANY,
.version = IKEV2,
.remote_port = IKEV2_UDP_PORT,
.fragmentation = FRAGMENTATION_YES,
.unique = UNIQUE_NO,
@@ -2936,6 +2936,14 @@ CALLBACK(config_sn, bool,
log_peer_data(&peer);
#ifdef USE_IKEV1
if (peer.version != IKEV2)
{
DBG0(DBG_CFG, "WARNING: IKEv1 support is deprecated and will be "
"removed soon, configure 'version = 2' in order to use IKEv2");
}
#endif
ike = (ike_cfg_create_t){
.version = peer.version,
.local = peer.local_addrs,