# Configuration for {{vpnservice.id}}
config setup

conn %default
        keylife=20m
        rekeymargin=3m
        keyingtries=1
        authby=psk
        mobike=no
{% for ipsec_site_connection in vpnservice.ipsec_site_connections%}
conn {{ipsec_site_connection.id}}
    keyexchange={{ipsec_site_connection.ikepolicy.ike_version}}
    left={{ipsec_site_connection.external_ip}}
    leftsubnet={{ipsec_site_connection['local_cidrs']|join(',')}}
    leftid={{ipsec_site_connection.local_id}}
    leftfirewall=yes
    right={{ipsec_site_connection.peer_address}}
    rightsubnet={{ipsec_site_connection['peer_cidrs']|join(',')}}
    rightid={{ipsec_site_connection.peer_id}}
    auto=route
    dpdaction={{ipsec_site_connection.dpd_action}}
    dpddelay={{ipsec_site_connection.dpd_interval}}s
    dpdtimeout={{ipsec_site_connection.dpd_timeout}}s
    ike={{ipsec_site_connection.ikepolicy.encryption_algorithm}}-{{ipsec_site_connection.ikepolicy.auth_algorithm}}-{{ipsec_site_connection.ikepolicy.pfs}}
    ikelifetime={{ipsec_site_connection.ikepolicy.lifetime_value}}s
    {%- if ipsec_site_connection.ikepolicy.phase1_negotiation_mode == "aggressive" %}
    aggressive=yes
    {%- endif %}
    {%- if ipsec_site_connection.ipsecpolicy.transform_protocol == "ah" %}
    ah={{ipsec_site_connection.ipsecpolicy.auth_algorithm}}-{{ipsec_site_connection.ipsecpolicy.pfs}}
    {%- else %}
    esp={{ipsec_site_connection.ipsecpolicy.encryption_algorithm}}-{{ipsec_site_connection.ipsecpolicy.auth_algorithm}}-{{ipsec_site_connection.ipsecpolicy.pfs}}
    {%- endif %}
    lifetime={{ipsec_site_connection.ipsecpolicy.lifetime_value}}s
    type={{ipsec_site_connection.ipsecpolicy.encapsulation_mode}}
{% endfor %}
