vici: Make IKEv2 the default IKE version

We don't want to accept IKEv1 clients anymore by default, so we also
warn them about it in the log.
This commit is contained in:
Tobias Brunner committed 2026-07-31 16:07:52 +02:00
1 parent e0fd0f51ea
commit bf438cb182
4 files changed
+16 -6

No files matched your search

+9 -1
View File
@@ -2804,7 +2804,7 @@ CALLBACK(config_sn, bool,
.send_certreq = TRUE,
.send_cert = CERT_SEND_IF_ASKED,
.ocsp = OCSP_SEND_REPLY,
.version = IKE_ANY,
.version = IKEV2,
.remote_port = IKEV2_UDP_PORT,
.fragmentation = FRAGMENTATION_YES,
.unique = UNIQUE_NO,
@@ -2936,6 +2936,14 @@ CALLBACK(config_sn, bool,
log_peer_data(&peer);
#ifdef USE_IKEV1
if (peer.version != IKEV2)
{
DBG0(DBG_CFG, "WARNING: IKEv1 support is deprecated and will be "
"removed soon, configure 'version = 2' in order to use IKEv2");
}
#endif
ike = (ike_cfg_create_t){
.version = peer.version,
.local = peer.local_addrs,