You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
- Introduces a new `vpn` app with the following models:
- Tunnel
- TunnelTermination
- IKEProposal
- IKEPolicy
- IPSecProposal
- IPSecPolicy
- IPSecProfile
NetBox can model private tunnels formed among virtual termination points across your network. Typical tunnel implementations include GRE, IP-in-IP, and IPSec. A tunnel may be terminated to two or more device or virtual machine interfaces.
An [Internet Key Exhcnage (IKE)](https://en.wikipedia.org/wiki/Internet_Key_Exchange) policy defines an IKE version, mode, and set of [proposals](./ikeproposal.md) to be used in IKE negotiation. These policies are referenced by [IPSec profiles](./ipsecprofile.md).
4
+
5
+
## Fields
6
+
7
+
### Name
8
+
9
+
The unique user-assigned name for the policy.
10
+
11
+
### Version
12
+
13
+
The IKE version employed (v1 or v2).
14
+
15
+
### Mode
16
+
17
+
The IKE mode employed (main or aggressive).
18
+
19
+
### Proposals
20
+
21
+
One or more [IKE proposals](./ikeproposal.md) supported for use by this policy.
22
+
23
+
### Pre-shared Key
24
+
25
+
A pre-shared secret key associated with this policy (optional).
An [Internet Key Exhcnage (IKE)](https://en.wikipedia.org/wiki/Internet_Key_Exchange) proposal defines a set of parameters used to establish a secure bidirectional connection across an untrusted medium, such as the Internet. IKE proposals defined in NetBox can be referenced by [IKE policies](./ikepolicy.md), which are in turn employed by [IPSec profiles](./ipsecprofile.md).
4
+
5
+
!!! note
6
+
Some platforms refer to IKE proposals as [ISAKMP](https://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol), which is a framework for authentication and key exchange which employs IKE.
7
+
8
+
## Fields
9
+
10
+
### Name
11
+
12
+
The unique user-assigned name for the proposal.
13
+
14
+
### Authentication Method
15
+
16
+
The strategy employed for authenticating the IKE peer. Available options are listed below.
17
+
18
+
| Name |
19
+
|----------------|
20
+
| Pre-shared key |
21
+
| Certificate |
22
+
| RSA signature |
23
+
| DSA signature |
24
+
25
+
### Encryption Algorithm
26
+
27
+
The protocol employed for data encryption. Options include DES, 3DES, and various flavors of AES.
28
+
29
+
### Authentication Algorithm
30
+
31
+
The mechanism employed to ensure data integrity. Options include MD5 and SHA HMAC implementations.
32
+
33
+
### Group
34
+
35
+
The [Diffie-Hellman group](https://en.wikipedia.org/wiki/Diffie%E2%80%93Hellman_key_exchange) supported by the proposal. Group IDs are [managed by IANA](https://www.iana.org/assignments/ikev2-parameters/ikev2-parameters.xhtml#ikev2-parameters-8).
36
+
37
+
### SA Lifetime
38
+
39
+
The maximum lifetime for the IKE security association (SA), in seconds.
An [IPSec](https://en.wikipedia.org/wiki/IPsec) policy defines a set of [proposals](./ikeproposal.md) to be used in the formation of IPSec tunnels. A perfect forward secrecy (PFS) group may optionally also be defined. These policies are referenced by [IPSec profiles](./ipsecprofile.md).
4
+
5
+
## Fields
6
+
7
+
### Name
8
+
9
+
The unique user-assigned name for the policy.
10
+
11
+
### Proposals
12
+
13
+
One or more [IPSec proposals](./ipsecproposal.md) supported for use by this policy.
14
+
15
+
### PFS Group
16
+
17
+
The [perfect forward secrecy (PFS)](https://en.wikipedia.org/wiki/Forward_secrecy) group supported by this policy (optional).
An [IPSec](https://en.wikipedia.org/wiki/IPsec) profile defines an [IKE policy](./ikepolicy.md), [IPSec policy](./ipsecpolicy.md), and IPSec mode used for establishing an IPSec tunnel.
4
+
5
+
## Fields
6
+
7
+
### Name
8
+
9
+
The unique user-assigned name for the profile.
10
+
11
+
### Mode
12
+
13
+
The IPSec mode employed by the profile: Encapsulating Security Payload (ESP) or Authentication Header (AH).
14
+
15
+
### IKE Policy
16
+
17
+
The [IKE policy](./ikepolicy.md) associated with the profile.
18
+
19
+
### IPSec Policy
20
+
21
+
The [IPSec policy](./ipsecpolicy.md) associated with the profile.
An [IPSec](https://en.wikipedia.org/wiki/IPsec) proposal defines a set of parameters used in negotiating security associations for IPSec tunnels. IPSec proposals defined in NetBox can be referenced by [IPSec policies](./ipsecpolicy.md), which are in turn employed by [IPSec profiles](./ipsecprofile.md).
4
+
5
+
## Fields
6
+
7
+
### Name
8
+
9
+
The unique user-assigned name for the proposal.
10
+
11
+
### Encryption Algorithm
12
+
13
+
The protocol employed for data encryption. Options include DES, 3DES, and various flavors of AES.
14
+
15
+
### Authentication Algorithm
16
+
17
+
The mechanism employed to ensure data integrity. Options include MD5 and SHA HMAC implementations.
18
+
19
+
### SA Lifetime (Seconds)
20
+
21
+
The maximum amount of time for which the security association (SA) may be active, in seconds.
22
+
23
+
### SA Lifetime (Data)
24
+
25
+
The maximum amount of data which can be transferred within the security association (SA) before it must be rebuilt, in kilobytes.
A tunnel represents a private virtual connection established among two or more endpoints across a shared infrastructure by employing protocol encapsulation. Common encapsulation techniques include [Generic Routing Encapsulation (GRE)](https://en.wikipedia.org/wiki/Generic_Routing_Encapsulation), [IP-in-IP](https://en.wikipedia.org/wiki/IP_in_IP), and [IPSec](https://en.wikipedia.org/wiki/IPsec). NetBox supports modeling both peer-to-peer and hub-and-spoke tunnel topologies.
4
+
5
+
Device and virtual machine interfaces are associated to tunnels by creating [tunnel terminations](./tunneltermination.md).
6
+
7
+
## Fields
8
+
9
+
### Name
10
+
11
+
A unique name assigned to the tunnel for identification.
12
+
13
+
### Status
14
+
15
+
The operational status of the tunnel. By default, the following statuses are available:
16
+
17
+
| Name |
18
+
|----------------|
19
+
| Planned |
20
+
| Active |
21
+
| Disabled |
22
+
23
+
!!! tip "Custom tunnel statuses"
24
+
Additional tunnel statuses may be defined by setting `Tunnel.status` under the [`FIELD_CHOICES`](../../configuration/data-validation.md#field_choices) configuration parameter.
25
+
26
+
### Encapsulation
27
+
28
+
The encapsulation protocol or technique employed to effect the tunnel. NetBox supports GRE, IP-in-IP, and IPSec encapsulations.
29
+
30
+
### Tunnel ID
31
+
32
+
An optional numeric identifier for the tunnel.
33
+
34
+
### IPSec Profile
35
+
36
+
For IPSec tunnels, this is the [IPSec Profile](./ipsecprofile.md) employed to negotiate security associations.
A tunnel termination connects a device or virtual machine interface to a [tunnel](./tunnel.md). The tunnel must be created before any terminations may be added.
4
+
5
+
## Fields
6
+
7
+
### Tunnel
8
+
9
+
The [tunnel](./tunnel.md) to which this termination is made.
10
+
11
+
### Role
12
+
13
+
The functional role of the attached interface. The following options are available:
0 commit comments