Merge "Add IPsec bypass policy for ICMP for IPv4"

2024-11-13 17:36:24 +00:00
parent 5a823d4637 ecbd90a1c5
commit f791795327
1 changed files with 13 additions and 0 deletions
--- a/sysinv/sysinv/sysinv/sysinv/ipsec_auth/client/config.py
+++ b/sysinv/sysinv/sysinv/sysinv/ipsec_auth/client/config.py
@@ -300,6 +300,19 @@ class StrongswanPuppet(object):
                },
            }
            swanctl.add_connection('ndp', conn)
+        # Add bypass connection for ping for IPv4.
+        else:
+            conn = {
+                'children': {
+                    'icmpv4-bypass': {
+                        'mode': 'pass',
+                        'start_action': 'trap',
+                        'local_ts': '\"0.0.0.0/0[icmp]\"',
+                        'remote_ts': '\"0.0.0.0/0[icmp]\"',
+                    },
+                },
+            }
+            swanctl.add_connection('ping', conn)

        config = {
            'platform::strongswan::params::swanctl':