Skip to content

Commit d735128

Browse files
author
Robert Poskevich III
committed
Added documentation for IPSEC manager and CLI commands. Removed iscsi manager documentation whose referenced manager class no longer exists. Updated IPSEC translation add and update commands to use 'note' value over 'notes'.
1 parent a5a80b2 commit d735128

File tree

6 files changed

+234
-13
lines changed

6 files changed

+234
-13
lines changed

‎SoftLayer/CLI/vpn/ipsec/translation/add.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,11 @@
2222
required=True,
2323
help='Remote IP address value')
2424
@click.option('-n',
25-
'--notes',
25+
'--note',
2626
default=None,
27-
help='Notes value')
27+
help='Note value')
2828
@environment.pass_env
29-
def cli(env, context_id, static_ip, remote_ip, notes):
29+
def cli(env, context_id, static_ip, remote_ip, note):
3030
"""Add an address translation to an IPSEC tunnel context.
3131
3232
A separate configuration request should be made to realize changes on
@@ -39,6 +39,6 @@ def cli(env, context_id, static_ip, remote_ip, notes):
3939
translation = manager.create_translation(context_id,
4040
static_ip=static_ip,
4141
remote_ip=remote_ip,
42-
notes=notes)
42+
notes=note)
4343
env.out('Created translation from {} to {} #{}'
4444
.format(static_ip, remote_ip, translation['id']))

‎SoftLayer/CLI/vpn/ipsec/translation/update.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,11 @@
2626
default=None,
2727
help='Remote IP address value')
2828
@click.option('-n',
29-
'--notes',
29+
'--note',
3030
default=None,
31-
help='Notes value')
31+
help='Note value')
3232
@environment.pass_env
33-
def cli(env, context_id, translation_id, static_ip, remote_ip, notes):
33+
def cli(env, context_id, translation_id, static_ip, remote_ip, note):
3434
"""Update an address translation for an IPSEC tunnel context.
3535
3636
A separate configuration request should be made to realize changes on
@@ -41,7 +41,7 @@ def cli(env, context_id, translation_id, static_ip, remote_ip, notes):
4141
translation_id,
4242
static_ip=static_ip,
4343
remote_ip=remote_ip,
44-
notes=notes)
44+
notes=note)
4545
if succeeded:
4646
env.out('Updated translation #{}'.format(translation_id))
4747
else:

‎docs/api/managers/ipsec.rst‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
.. _ipsec:
2+
3+
.. automodule:: SoftLayer.managers.ipsec
4+
:members:
5+
:inherited-members:

‎docs/api/managers/iscsi.rst‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎docs/cli.rst‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ functionality not fully documented here.
1212
.. toctree::
1313
:maxdepth: 2
1414

15+
cli/ipsec
1516
cli/vs
1617

1718

‎docs/cli/ipsec.rst‎

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
.. _cli_ipsec:
2+
3+
Interacting with IPSEC Tunnels
4+
==============================
5+
The IPSEC :ref:`cli` commands can be used to configure an existing IPSEC tunnel context. Subnets in the SoftLayer private network can be associated to the tunnel context along with user-defined remote subnets. Address translation entries may also be defined to provide NAT functionality from static subnet IP addresses associated with the tunnel context to user-defined remote subnet IP addresses.
6+
7+
.. note::
8+
9+
Most CLI actions that affect an IPSEC tunnel context do not result in configuration changes to SoftLayer network devices. A separate *configure* command is available to issue a device configuration request.
10+
11+
To see more information about the IPSEC tunnel context module and API internaction, see :doc:`IPSEC Module<../api/managers/ipsec>` documentation.
12+
13+
.. _cli_ipsec_list:
14+
15+
ipsec list
16+
----------
17+
A list of all IPSEC tunnel contexts associated with the current user's account can be retrieved via the ``ipsec list`` command. This provides a brief overview of all tunnel contexts and can be used to retrieve an individual context's identifier, which all other CLI commands require.
18+
::
19+
20+
$ slcli ipsec list
21+
:.....:..........:...............:..........................:........................:...........................:
22+
: id : name : friendly name : internal peer IP address : remote peer IP address : created :
23+
:.....:..........:...............:..........................:........................:...........................:
24+
: 445 : ipsec038 : ipsec tunnel : 173.192.250.79 : 158.85.80.22 : 2012-03-05T14:07:34-06:00 :
25+
:.....:..........:...............:..........................:........................:...........................:
26+
27+
.. _cli_ipsec_detail:
28+
29+
ipsec detail
30+
------------
31+
More detailed information can be retrieved for an individual context using the ``ipsec detail`` command. Using the detail command, information about associated internal subnets, remote subnets, static subnets, service subnets and address translations may also be retrieved using multiple instances of the ``-i|--include`` option.
32+
::
33+
34+
$ slcli ipsec detail 445 -i at -i is -i rs -i sr -i ss
35+
Context Details:
36+
:.................................:...........................:
37+
: name : value :
38+
:.................................:...........................:
39+
: id : 445 :
40+
: name : ipsec038 :
41+
: friendly name : ipsec tunnel :
42+
: internal peer IP address : 173.192.250.79 :
43+
: remote peer IP address : 158.85.80.22 :
44+
: advanced configuration flag : 0 :
45+
: preshared key : secret :
46+
: phase 1 authentication : MD5 :
47+
: phase 1 diffie hellman group : 0 :
48+
: phase 1 encryption : DES :
49+
: phase 1 key life : 240 :
50+
: phase 2 authentication : MD5 :
51+
: phase 2 diffie hellman group : 1 :
52+
: phase 2 encryption : DES :
53+
: phase 2 key life : 240 :
54+
: phase 2 perfect forward secrecy : 1 :
55+
: created : 2012-03-05T14:07:34-06:00 :
56+
: modified : 2017-05-17T12:01:33-06:00 :
57+
:.................................:...........................:
58+
Address Translations:
59+
:.......:...................:......................:...................:......................:.................:
60+
: id : static IP address : static IP address id : remote IP address : remote IP address id : note :
61+
:.......:...................:......................:...................:......................:.................:
62+
: 15920 : 10.1.249.86 : 9791681 : 158.85.80.22 : 98828 : windows server :
63+
: 15918 : 10.1.249.84 : 9791679 : 158.85.80.20 : 98824 : unix server :
64+
:.......:...................:......................:...................:......................:.................:
65+
Internal Subnets:
66+
:........:....................:......:......:
67+
: id : network identifier : cidr : note :
68+
:........:....................:......:......:
69+
: 180767 : 10.28.67.128 : 26 : :
70+
:........:....................:......:......:
71+
Remote Subnets:
72+
:......:....................:......:......:
73+
: id : network identifier : cidr : note :
74+
:......:....................:......:......:
75+
: 7852 : 158.85.80.20 : 30 : :
76+
:......:....................:......:......:
77+
Static Subnets:
78+
:........:....................:......:......:
79+
: id : network identifier : cidr : note :
80+
:........:....................:......:......:
81+
: 231807 : 10.1.249.84 : 30 : :
82+
:........:....................:......:......:
83+
Service Subnets:
84+
:........:....................:......:......:
85+
: id : network identifier : cidr : note :
86+
:........:....................:......:......:
87+
: 162079 : 10.0.80.0 : 25 : :
88+
:........:....................:......:......:
89+
90+
.. _cli_ipsec_update:
91+
92+
ipsec update
93+
------------
94+
Most values listed in the tunnel context detail printout can be modified using the ``ipsec update`` command. The following is given when executing with the ``-h|--help`` option and highlights all properties that may be modified.
95+
::
96+
97+
$ slcli ipsec update -h
98+
Usage: slcli ipsec update [OPTIONS] CONTEXT_ID
99+
100+
Update tunnel context properties.
101+
102+
Updates are made atomically, so either all are accepted or none are.
103+
104+
Key life values must be in the range 120-172800.
105+
106+
Phase 2 perfect forward secrecy must be in the range 0-1.
107+
108+
A separate configuration request should be made to realize changes on
109+
network devices.
110+
111+
Options:
112+
--friendly-name TEXT Friendly name value
113+
--remote-peer TEXT Remote peer IP address value
114+
--preshared-key TEXT Preshared key value
115+
--p1-auth, --phase1-auth [MD5|SHA1|SHA256]
116+
Phase 1 authentication value
117+
--p1-crypto, --phase1-crypto [DES|3DES|AES128|AES192|AES256]
118+
Phase 1 encryption value
119+
--p1-dh, --phase1-dh [0|1|2|5] Phase 1 diffie hellman group value
120+
--p1-key-ttl, --phase1-key-ttl INTEGER RANGE
121+
Phase 1 key life value
122+
--p2-auth, --phase2-auth [MD5|SHA1|SHA256]
123+
Phase 2 authentication value
124+
--p2-crypto, --phase2-crypto [DES|3DES|AES128|AES192|AES256]
125+
Phase 2 encryption value
126+
--p2-dh, --phase2-dh [0|1|2|5] Phase 2 diffie hellman group value
127+
--p2-forward-secrecy, --phase2-forward-secrecy INTEGER RANGE
128+
Phase 2 perfect forward secrecy value
129+
--p2-key-ttl, --phase2-key-ttl INTEGER RANGE
130+
Phase 2 key life value
131+
-h, --help Show this message and exit.
132+
133+
.. _cli_ipsec_configure:
134+
135+
ipsec configure
136+
---------------
137+
A request to configure SoftLayer network devices for a given tunnel context can be issued using the ``ipsec configure`` command.
138+
139+
.. note::
140+
141+
Once a configuration request is received, the IPSEC tunnel context will be placed into an unmodifiable state, and further changes against the tunnel context will be prevented. Once configuration changes have been made, the tunnel context may again be modified. The unmodifiable state of a tunnel context is indicated by an *advanced configuration flag* value of 1.
142+
143+
.. _cli_ipsec_subnet_add:
144+
145+
ipsec subnet-add
146+
----------------
147+
Internal, remote and service subnets can be associated to an IPSEC tunnel context using the ``ipsec subnet-add`` command. Additionally, remote subnets can be created using this same command, which will then be associated to the targeted tunnel context.
148+
149+
.. note::
150+
151+
The targeted subnet type must be specified. A subnet id must be provided when associating internal and service subnets. Either a subnet id or a network identifier must be provided when associating remote subnets. If a network identifier is provided when associating a remote subnet, that subnet will first be created and then associated to the tunnel context.
152+
153+
The following is an exmaple of associating an internal subnet to a tunnel context.
154+
::
155+
156+
$ slcli ipsec subnet-add 445 --subnet-id 180767 --subnet-type internal
157+
Added internal subnet #180767
158+
159+
The following is an example of creating and associating a remote subnet to a tunnel context.
160+
::
161+
162+
$ slcli ipsec subnet-add 445 --subnet-type remote --network 50.100.0.0/26
163+
Created subnet 50.100.0.0/26 #21268
164+
Added remote subnet #21268
165+
166+
.. _cli_ipsec_subnet_remove:
167+
168+
ipsec subnet-remove
169+
-------------------
170+
Internal, remote and service subnets can be disassociated from an IPSEC tunnel context via the ``ipsec subnet-remove`` command.
171+
172+
.. note::
173+
174+
The targeted subnet id and type must be specified. When disassociating remote subnets, that subnet record will also be deleted.
175+
176+
The following is an example of disassociating an internal subnet from a tunnel context.
177+
::
178+
179+
$ slcli ipsec subnet-remove 445 --subnet-id 180767 --subnet-type internal
180+
Removed internal subnet #180767
181+
182+
.. _cli_ipsec_translation_add:
183+
184+
ipsec translation-add
185+
---------------------
186+
Address translation entries can be added to a tunnel context to provide NAT functionality from a statically routed subnet associated with the tunnel context to a remote subnet. This action is performed with the ``ipsec translation-add`` command.
187+
188+
.. note::
189+
190+
Both static and remote IP address values must be specified. An optional note value may also be provided.
191+
192+
The following is an example of adding a new address translation entry.
193+
::
194+
195+
$ slcli ipsec translation-add 445 --static-ip 10.1.249.87 --remote-ip 50.100.0.10 --note 'email server'
196+
Created translation from 10.1.249.87 to 50.100.0.10 #15922
197+
198+
.. _cli_ipsec_translation_remove:
199+
200+
ipsec translation-remove
201+
------------------------
202+
Address translation entries can be removed using the ``ipsec translation-remove`` command.
203+
204+
The following is an example of removing an address translation entry.
205+
::
206+
207+
$ slcli ipsec translation-remove 445 --translation-id 15922
208+
Removed translation #15922
209+
210+
.. _cli_ipsec_translation_update:
211+
212+
ipsec translation-update
213+
------------------------
214+
Address translation entries may also be modified using the ``ipsec translation-update`` command.
215+
216+
The following is an example of updating an existing address translation entry.
217+
::
218+
219+
$ slcli ipsec translation-update 445 --translation-id 15924 --static-ip 10.1.249.86 --remote-ip 50.100.0.8 --note 'new email server'
220+
Updated translation #15924

0 commit comments

Comments
 (0)