-
Notifications
You must be signed in to change notification settings - Fork 61
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
acc215d
commit 74a9241
Showing
14 changed files
with
448 additions
and
4 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,70 @@ | ||
| # routeros_ip_ipsec_identity (Resource) | ||
|
|
||
|
|
||
| ## Example Usage | ||
| ```terraform | ||
| resource "routeros_ip_ipsec_mode_config" "test" { | ||
| name = "NordVPN" | ||
| responder = false | ||
| } | ||
| resource "routeros_ip_ipsec_peer" "test" { | ||
| address = "lv20.nordvpn.com" | ||
| exchange_mode = "ike2" | ||
| name = "NordVPN" | ||
| } | ||
| resource "routeros_ip_ipsec_identity" "test" { | ||
| auth-method = "eap" | ||
| certificate = "" | ||
| eap-methods = "eap-mschapv2" | ||
| generate-policy = "port-strict" | ||
| mode-config = routeros_ip_ipsec_mode_config.test.name | ||
| peer = routeros_ip_ipsec_peer.test.name | ||
| username = "[email protected]" | ||
| password = "secret" | ||
| } | ||
| ``` | ||
|
|
||
| <!-- schema generated by tfplugindocs --> | ||
| ## Schema | ||
|
|
||
| ### Required | ||
|
|
||
| - `peer` (String) Name of the peer on which the identity applies. | ||
|
|
||
| ### Optional | ||
|
|
||
| - `auth_method` (String) Authentication method: `digital-signature` - authenticate using a pair of RSA certificates; `eap` - IKEv2 EAP authentication for initiator (peer with a netmask of `/32`). Must be used together with eap-methods; `eap-radius` - IKEv2 EAP RADIUS passthrough authentication for the responder (RFC 3579). A server certificate in this case is required. If a server certificate is not specified then only clients supporting EAP-only (RFC 5998) will be able to connect. Note that the EAP method should be compatible with EAP-only; `pre-shared-key` - authenticate by a password (pre-shared secret) string shared between the peers (not recommended since an offline attack on the pre-shared key is possible); `rsa-key` - authenticate using an RSA key imported in keys menu. Only supported in IKEv1; `pre-shared-key-xauth` - authenticate by a password (pre-shared secret) string shared between the peers + XAuth username and password. Only supported in IKEv1; `rsa-signature-hybrid` - responder certificate authentication with initiator XAuth. Only supported in IKEv1. | ||
| - `certificate` (String) Name of a certificate listed in System/Certificates (signing packets; the certificate must have the private key). Applicable if digital signature authentication method (`auth-method=digital-signature`) or EAP (a`uth-method=eap`) is used. | ||
| - `comment` (String) | ||
| - `disabled` (Boolean) | ||
| - `eap_methods` (String) All EAP methods requires whole certificate chain including intermediate and root CA certificates to be present in System/Certificates menu. Also, the username and password (if required by the authentication server) must be specified. Multiple EAP methods may be specified and will be used in a specified order. Currently supported EAP methods: `eap-mschapv2`; `eap-peap` - also known as PEAPv0/EAP-MSCHAPv2; `eap-tls` - requires additional client certificate specified under certificate parameter; `eap-ttls`. | ||
| - `generate_policy` (String) Allow this peer to establish SA for non-existing policies. Such policies are created dynamically for the lifetime of SA. Automatic policies allows, for example, to create IPsec secured L2TP tunnels, or any other setup where remote peer's IP address is not known at the configuration time. `no` - do not generate policies; `port-override` - generate policies and force policy to use any port (old behavior); `port-strict` - use ports from peer's proposal, which should match peer's policy. | ||
| - `key` (String) Name of the private key from keys menu. Applicable if RSA key authentication method (`auth-method=rsa-key`) is used. | ||
| - `match_by` (String) Defines the logic used for peer's identity validation. `remote-id` - will verify the peer's ID according to remote-id setting. `certificate` will verify the peer's certificate with what is specified under remote-certificate setting. | ||
| - `mode_config` (String) Name of the configuration parameters from mode-config menu. When parameter is set mode-config is enabled. | ||
| - `my_id` (String) On initiator, this controls what ID_i is sent to the responder. On responder, this controls what ID_r is sent to the initiator. In IKEv2, responder also expects this ID in received ID_r from initiator. `auto` - tries to use correct ID automatically: IP for pre-shared key, SAN (DN if not present) for certificate based connections; `address` - IP address is used as ID;dn - the binary Distinguished Encoding Rules (DER) encoding of an ASN.1 X.500 Distinguished Name; `fqdn` - fully qualified domain name; `key-id` - use the specified key ID for the identity; `user-fqdn` - specifies a fully-qualified username string, for example, `[email protected]`. | ||
| - `notrack_chain` (String) Adds IP/Firewall/Raw rules matching IPsec policy to a specified chain. Use together with generate-policy. | ||
| - `password` (String, Sensitive) XAuth or EAP password. Applicable if pre-shared key with XAuth authentication method (`auth-method=pre-shared-key-xauth`) or EAP (`auth-method=eap`) is used. | ||
| - `policy_template_group` (String) If generate-policy is enabled, traffic selectors are checked against templates from the same group. If none of the templates match, Phase 2 SA will not be established. | ||
| - `remote_certificate` (String) Name of a certificate (listed in `System/Certificates`) for authenticating the remote side (validating packets; no private key required). If a remote-certificate is not specified then the received certificate from a remote peer is used and checked against CA in the certificate menu. Proper CA must be imported in a certificate store. If remote-certificate and match-by=certificate is specified, only the specific client certificate will be matched. Applicable if digital signature authentication method (`auth-method=digital-signature`) is used. | ||
| - `remote_id` (String) This parameter controls what ID value to expect from the remote peer. Note that all types except for ignoring will verify remote peer's ID with a received certificate. In case when the peer sends the certificate name as its ID, it is checked against the certificate, else the ID is checked against Subject Alt. Name. `auto` - accept all ID's;address - IP address is used as ID;dn - the binary Distinguished Encoding Rules (DER) encoding of an ASN.1 X.500 Distinguished Name; `fqdn` - fully qualified domain name. Only supported in IKEv2; `user-fqdn` - a fully-qualified username string, for example, `[email protected]`. Only supported in IKEv2; `key-id` - specific key ID for the identity. Only supported in IKEv2; `ignore` - do not verify received ID with certificate (dangerous). * Wildcard key ID matching **is not supported**, for example `remote-id=`key-id:CN=*.domain.com`. | ||
| - `remote_key` (String) Name of the public key from keys menu. Applicable if RSA key authentication method (`auth-method=rsa-key`) is used. | ||
| - `secret` (String, Sensitive) Secret string. If it starts with '0x', it is parsed as a hexadecimal value. Applicable if pre-shared key authentication method (`auth-method=pre-shared-key` and `auth-method=pre-shared-key-xauth`) is used. | ||
| - `username` (String) XAuth or EAP username. Applicable if pre-shared key with XAuth authentication method (`auth-method=pre-shared-key-xauth`) or EAP (`auth-method=eap`) is used. | ||
|
|
||
| ### Read-Only | ||
|
|
||
| - `dynamic` (Boolean) Configuration item created by software, not by management interface. It is not exported, and cannot be directly modified. | ||
| - `id` (String) The ID of this resource. | ||
|
|
||
| ## Import | ||
| Import is supported using the following syntax: | ||
| ```shell | ||
| #The ID can be found via API or the terminal | ||
| #The command for the terminal is -> :put [/ip/ipsec/identity get [print show-ids]] | ||
| terraform import routeros_ip_ipsec_identity.test *3 | ||
| #Or you can import a resource using one of its attributes | ||
| terraform import routeros_ip_ipsec_identity.test "peer=NordVPN" | ||
| ``` |
Oops, something went wrong.