policy

---

ip/ipsec/policy

Type: Directory

info

Policy order is important. It works similarly to firewall filters where policies are executed from top to bottom (priority parameter is removed).

All packets are IPIP encapsulated in tunnel mode, and their new IP header's src-address and dst-address are set to sa-src-address and sa-dst-address values of this policy. If you do not use tunnel mode (i.e., you use transport mode), then only packets whose source and destination addresses are the same as sa-src-address and sa-dst-address can be processed by this policy. Transport mode can only work with packets that originate at and are destined for IPsec peers (hosts that established security associations). To encrypt traffic between networks (or a network and a host) you have to use tunnel mode.

Flag	Name	Description
T	template	Whether the item is a template to assign for dynamic peers.
B	backup	Whether the item is included in the backup.
X	disabled	Whether the item is disabled.
D	dynamic	Whether the item was created dynamically.
I	invalid	Whether this policy is invalid - the possible cause is a duplicate policy with the same src-address and dst-address.
A	active	Whether the item is currently active.
*	default	Whether the item is the default.

Argument	Type	Description
peer	multi { array-id, peer: enum }	Name of the peer on which the policy applies.c
tunnel	bool	Whether to use tunnel mode.
group	enum	Policy group name.
src-address	alt { prefix6: ip6Prefix , prefix4: ipPrefix }	Source address or network to be matched in packets. Applicable when tunnel mode (tunnel=yes) or template (template=yes) is used.
src-port	num	Source port.
dst-address	alt { prefix6: ip6Prefix , prefix4: ipPrefix }	Destination address or network to be matched in packets. Applicable when tunnel mode (tunnel=yes) or template (template=yes) is used.
dst-port	num	Destination port.
protocol	enum (all) { all:255 }	IP protocol number or name.
action	enum (encrypt | discard | none) { encrypt:2, discard:0, none:1 }	Action to take for matching traffic. none - pass the packet unchanged. discard - drop the packet. encrypt - apply transformations specified in this policy and its SA.
level	enum (require | use | unique) { require:2, use:1, unique:3 }	Specifies what to do if some of the SAs for this policy cannot be found: use - skip this transform, do not drop the packet, and do not acquire SA from IKE daemon; require - drop the packet and acquire SA; unique - drop the packet and acquire a unique SA that is only used with this particular policy. It is used in setups where multiple clients can sit behind one public IP address (clients behind NAT).
ipsec-protocols	enum (ah | esp) { ah:1, esp:2 }	Specifies what combination of Authentication Header and Encapsulating Security Payload protocols you want to apply to matched traffic.
sa-src-address	alt { ipv6: ip6Addr , ip: ipAddr }	endpoint address
sa-dst-address	alt { ipv6: ip6Addr , ip: ipAddr }	endpoint address
proposal	enum	Proposal template name.
template	bool	Whether this policy is a template.

Read-only Argument	Type	Description
active-interface	iface_enum	The interface through which the SA is established.
ph2-count	num	Number of phase 2 exchanges.
ph2-state	enum (spawning | starting | ready-to-send | getspi-sent | getspi-done | msg1-sent | ready-to-establish | commiting | adding-sa | established | expired | no-phase2) { spawning:0, starting:1, ready-to-send:2, getspi-sent:3, getspi-done:4, msg1-sent:5, ready-to-establish:6, commiting:7, adding-sa:8, established:9, expired:10, no-phase2:11 }	Current phase 2 state.