denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ike-vendor: Add option to send Cisco FLexVPN vendor ID

Browse Source 
A new global option enables sending this vendor ID to prevent Cisco
devices from narrowing the initiator's local traffic selector to the
requested virtual IP, so e.g. 0.0.0.0/0 can be used instead.

This has been tested with a "tunnel mode ipsec ipv4" Cisco template but
should also work for GRE encapsulation.

Closes strongswan/strongswan#180.
This commit is contained in:
Noel Kuntze
2020-09-10 12:01:44 +02:00
committed by Tobias Brunner
parent dc0c20600f
commit d1d5659ead
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
conf/options/charon.opt
+12
View File
@@ -51,6 +51,18 @@ charon.check_current_path = no
connectivity. It will also trigger a MOBIKE update if NAT mappings were
removed during the downtime.
charon.cisco_flexvpn = no
Send the Cisco FlexVPN vendor ID payload (IKEv2 only).
Send the Cisco FlexVPN vendor ID payload, which is required in order to make
Cisco brand devices allow negotiating a local traffic selector (from
strongSwan's point of view) that is not the assigned virtual IP address if
such an address is requested by strongSwan. Sending the Cisco FlexVPN
vendor ID prevents the peer from narrowing the initiator's local traffic
selector and allows it to e.g. negotiate a TS of 0.0.0.0/0 == 0.0.0.0/0
instead. This has been tested with a "tunnel mode ipsec ipv4" Cisco
template but should also work for GRE encapsulation.
charon.cisco_unity = no
Send Cisco Unity vendor ID payload (IKEv1 only).