Skip to content

Creating P1 VPN does not support CARP VIP #758

@robindbe

Description

@robindbe

Describe the bug
When adding an IPsec P1, using a carp VIP is not supported, only fixed interfaces. This is the error:

message: Field `interface` must be one of [wan, lan, opt1, opt2, opt3, opt4, opt5, opt6]

This worked in v1 of the API, we noticed when migrating calls to v2.

To Reproduce
Steps to reproduce the behavior:
Add a phase 1 VPN (/api/v2/vpn/ipsec/phase1) using the identifier of a CARP VIP (_vip) in the interface field.

This is an example call:

       body:
                apply: false
                authentication_method: pre_shared_key
                descr: S2S-TEST
                disabled: false
                dpd_delay: 10
                dpd_enable: enable
                dpd_maxfail: 5
                encryption:
                    item:
                    -   dhgroup: '20'
                        encryption-algorithm:
                            keylen: '256'
                            name: aes
                        hash-algorithm: sha512
                        prf-algorithm: sha512
                gw_duplicates: false
                ikeport: 500
                iketype: ikev2
                interface: _vip68d40168c2591
                lifetime: 86400
                mobike: false
                myid_type: myaddress
                nattport: 4500
                nattraversal: 'on'
                peerid_type: peeraddress
                pre-shared-key: 2u2nYsApKHBGhfFfwf6SJhQepaAC3E6IhzTgeaaRkEDQplW7ajGlXRy1
                prfselect_enable: false
                protocol: inet
                remote-gateway: 1.1.1.1
                splitconn: false

Expected behavior
When having a cluster using CARP, using the CARP VIP is needed as local VPN endpoint to allow it to failover.

pfSense Version & Package Version:

  • pfSense Version: 2.8.1
  • Package Version 2.6.2

Affected Endpoints:

  • URL: /api/v2/vpn/ipsec/phase1

Additional context
Add any other context about the problem here.

Metadata

Metadata

Labels

enhancementIssues or PRs that enhance existing features

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions