{#
#
# Copyright (c) 2015, 2016, Oracle and/or its affiliates. All rights reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#
#}
#    IKE Configuration for vpn-service "{{vpnservice.id}}"
# Configuration for vpn-service "{{vpnservice.id}}"
{% for ipsec_site_connection in vpnservice.ipsec_site_connections if ipsec_site_connection.admin_state_up
%}
{% set aalg=ipsec_site_connection.ipsecpolicy.auth_algorithm %}
{% set ealg=ipsec_site_connection.ipsecpolicy.encryption_algorithm %}
{% set tun_name=ipsec_site_connection['tunnel_id'] %}
{% if ipsec_site_connection.ipsecpolicy.transform_protocol == "esp" %}
    {% set atok="encr_auth_algs" %}
{% else %}
    {% set atok="auth_algs" %}
{% endif %}
{% if ipsec_site_connection.ipsecpolicy.transform_protocol == "ah" %}
    {% set etok="" %}
    {% set ealg="" %}
{% else %}
    {% set etok="encr_algs" %}
{% endif %}
{% set laddr=vpnservice.subnet.cidr %}
{% set raddr=ipsec_site_connection['peer_cidrs']|join(' ') %}
{# We can support Combined modes algorithms by configuring the authentication
# and encryption algorithms as the same value.
#}
{% if aalg == ealg %}
    {% set atok="" %}
    {% set aalg="" %}
{% endif %}

{ tunnel {{tun_name}} negotiate tunnel laddr {{laddr}} raddr {{raddr}} } ipsec
          { {{atok}} {{aalg}} {{etok}} {{ealg}} sa shared }

{% endfor %}