Skip to content

Commit a8b99f7

Browse files
DidainiusDidainius
authored
NSX-T IPSec VPN improvements (#553)
1 parent edf562c commit a8b99f7

File tree

8 files changed

+219
-93
lines changed

8 files changed

+219
-93
lines changed

‎.changes/v2.20.0/553-improvements.md

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
* Improve NSX-T IPSec VPN type `types.NsxtIpSecVpnTunnel` to support 'Certificate' Authentication
2+
mode [GH-553]

‎govcd/certificates_embedded_test.go

+4-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
//go:build functional || openapi || certificate || alb || nsxt || ALL
1+
//go:build functional || openapi || certificate || alb || nsxt || network || ALL
22

33
/*
44
* Copyright 2021 VMware, Inc. All rights reserved. Licensed under the Apache v2 License.
@@ -16,4 +16,7 @@ var (
1616

1717
//go:embed test-resources/key.pem
1818
privateKey string
19+
20+
//go:embed test-resources/rootCA.pem
21+
rootCaCertificate string
1922
)

‎govcd/nsxt_ipsec_vpn_tunnel_test.go

+85-3
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,10 @@ func (vcd *TestVCD) Test_NsxtIpSecVpnCustomSecurityProfile(check *C) {
5858
check.Assert(err, IsNil)
5959

6060
ipSecDef := &types.NsxtIpSecVpnTunnel{
61-
Name: check.TestName(),
62-
Description: check.TestName() + "-description",
63-
Enabled: true,
61+
Name: check.TestName(),
62+
Description: check.TestName() + "-description",
63+
Enabled: true,
64+
AuthenticationMode: types.NsxtIpSecVpnAuthenticationModePSK, // Default value even when it is unset
6465
LocalEndpoint: types.NsxtIpSecVpnTunnelLocalEndpoint{
6566
LocalAddress: edge.EdgeGateway.EdgeGatewayUplinks[0].Subnets.Values[0].PrimaryIP,
6667
LocalNetworks: []string{"10.10.10.0/24"},
@@ -234,3 +235,84 @@ func runIpSecVpnTests(check *C, edge *NsxtEdgeGateway, ipSecDef *types.NsxtIpSec
234235
check.Assert(vpnConfig.IsEqualTo(updatedIpSecVpn.NsxtIpSecVpn), Equals, false)
235236
}
236237
}
238+
239+
func (vcd *TestVCD) Test_NsxtIpSecVpnCertificateAuth(check *C) {
240+
skipNoNsxtConfiguration(vcd, check)
241+
skipOpenApiEndpointTest(vcd, check, types.OpenApiPathVersion1_0_0+types.OpenApiEndpointFirewallGroups)
242+
243+
org, err := vcd.client.GetOrgByName(vcd.config.VCD.Org)
244+
check.Assert(err, IsNil)
245+
246+
adminOrg, err := vcd.client.GetAdminOrgByName(vcd.config.VCD.Org)
247+
check.Assert(err, IsNil)
248+
249+
nsxtVdc, err := org.GetVDCByName(vcd.config.VCD.Nsxt.Vdc, false)
250+
check.Assert(err, IsNil)
251+
252+
edge, err := nsxtVdc.GetNsxtEdgeGatewayByName(vcd.config.VCD.Nsxt.EdgeGateway)
253+
check.Assert(err, IsNil)
254+
255+
// Upload Certificates to use in the test
256+
aliasForPrivateKey := check.TestName() + "cert-with-private-key"
257+
privateKeyPassphrase := "test"
258+
certificateWithPrivateKeyConfig := &types.CertificateLibraryItem{
259+
Alias: aliasForPrivateKey,
260+
Certificate: certificate,
261+
PrivateKey: privateKey,
262+
PrivateKeyPassphrase: privateKeyPassphrase,
263+
}
264+
265+
certWithKey, err := adminOrg.AddCertificateToLibrary(certificateWithPrivateKeyConfig)
266+
check.Assert(err, IsNil)
267+
openApiEndpoint, err := getEndpointByVersion(&vcd.client.Client)
268+
check.Assert(err, IsNil)
269+
check.Assert(openApiEndpoint, NotNil)
270+
PrependToCleanupListOpenApi(certWithKey.CertificateLibrary.Alias, check.TestName(),
271+
openApiEndpoint+certWithKey.CertificateLibrary.Id)
272+
273+
// Upload CA Certificate to use in the test
274+
aliasForCaCertificate := check.TestName() + "ca-certificate"
275+
caCertificateConfig := &types.CertificateLibraryItem{
276+
Alias: aliasForCaCertificate,
277+
Certificate: rootCaCertificate,
278+
}
279+
280+
caCert, err := adminOrg.AddCertificateToLibrary(caCertificateConfig)
281+
check.Assert(err, IsNil)
282+
PrependToCleanupListOpenApi(caCert.CertificateLibrary.Alias, check.TestName(),
283+
openApiEndpoint+caCert.CertificateLibrary.Id)
284+
285+
// Create IPSec VPN configuration with certificate authentication mode
286+
ipSecDef := &types.NsxtIpSecVpnTunnel{
287+
Name: check.TestName(),
288+
Description: check.TestName() + "-description",
289+
Enabled: true,
290+
AuthenticationMode: types.NsxtIpSecVpnAuthenticationModeCertificate,
291+
CertificateRef: &types.OpenApiReference{
292+
ID: certWithKey.CertificateLibrary.Id,
293+
},
294+
CaCertificateRef: &types.OpenApiReference{
295+
ID: caCert.CertificateLibrary.Id,
296+
},
297+
298+
LocalEndpoint: types.NsxtIpSecVpnTunnelLocalEndpoint{
299+
LocalAddress: edge.EdgeGateway.EdgeGatewayUplinks[0].Subnets.Values[0].PrimaryIP,
300+
LocalNetworks: []string{"10.10.10.0/24"},
301+
},
302+
RemoteEndpoint: types.NsxtIpSecVpnTunnelRemoteEndpoint{
303+
RemoteId: "custom-remote-id",
304+
RemoteAddress: "192.168.140.1",
305+
RemoteNetworks: []string{"20.20.20.0/24"},
306+
},
307+
SecurityType: "DEFAULT",
308+
Logging: true,
309+
}
310+
311+
runIpSecVpnTests(check, edge, ipSecDef)
312+
313+
// cleanup uploaded certificates
314+
err = certWithKey.Delete()
315+
check.Assert(err, IsNil)
316+
err = caCert.Delete()
317+
check.Assert(err, IsNil)
318+
}

‎govcd/test-resources/cert.pem

+25-31
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,27 @@
11
-----BEGIN CERTIFICATE-----
2-
MIIFxzCCA6+gAwIBAgIUVbryzlRw0ahAY7e9sCTJQN5Q5VowDQYJKoZIhvcNAQEL
3-
BQAwcjELMAkGA1UEBhMCVVMxDzANBgNVBAgMBk9yZWdvbjERMA8GA1UEBwwIUG9y
4-
dGxhbmQxFTATBgNVBAoMDENvbXBhbnkgTmFtZTEMMAoGA1UECwwDT3JnMRowGAYD
5-
VQQDDBFvdGhlci5leGFtcGxlLmNvbTAgFw0yMTEwMTIxMTExMjdaGA80NzU5MDkw
6-
ODExMTEyN1owcjELMAkGA1UEBhMCVVMxDzANBgNVBAgMBk9yZWdvbjERMA8GA1UE
7-
BwwIUG9ydGxhbmQxFTATBgNVBAoMDENvbXBhbnkgTmFtZTEMMAoGA1UECwwDT3Jn
8-
MRowGAYDVQQDDBFvdGhlci5leGFtcGxlLmNvbTCCAiIwDQYJKoZIhvcNAQEBBQAD
9-
ggIPADCCAgoCggIBAPFoIdcexAQJ86OgmU7pS8Wli887AEBUfjIm57vLa7aESwr1
10-
iI9nABH1Nfgxewj3wp/NtGBpv1TpmlK2L76Wu5veVQ+HnhVZvm+Ya0mIRtbwUyyQ
11-
WN+ECaJ+E6IGFJqGJjrb5ERu6UOK1CzD5gpaKzHfA0oLWyUzmS6js3Cv8Ln4WiYH
12-
qK7V1ktFU7pABZk3n58oBYZ+KPzThzuUJqrv0PnYpl/Q5WvpWlEpt1P/IsRLKOop
13-
q1nMWBB3QKhGAMdaxZELUbw19+9+cEiQZUruOVYBnzKZQMItmIkr+aWRk/XmHn92
14-
4f13RtPLM4uSWGmr2uG5IBwquxfeJsxSPn9nocs8uTJ9JRodTpyLGbqFdw4Vw10h
15-
X6LRMvyEuuNvUpKMTF8lGL3v+hIXfx222aB7pH+hnRYHKNb+m0j+J2MQ9O/MNrHz
16-
LRt/90t8YqHmJBOK9iDGKTjgmuZlshyfgvy89nzlvbKc90df3VI6To/TIKt5tBdC
17-
jXLxQ+TL6DGL25uPpa7ZHyuKAywHhKBZV6R4jY4wuRuH38LX0fkMdOToYwKZA38M
18-
5QzTCs9SXtoark3DtKwqaMHWdJk9BviatVaNmLLLerkYDMY/rjR3pGcaa8wCCPNY
19-
HbzNbC6rD8eyaCluUFVoXLQyJcacA7wzhSR/jeC9G70onPlx0SWl+zzwM5udAgMB
20-
AAGjUzBRMB0GA1UdDgQWBBRw8FkiYFaoUxPOLBkt43TQ1nK36DAfBgNVHSMEGDAW
21-
gBRw8FkiYFaoUxPOLBkt43TQ1nK36DAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
22-
DQEBCwUAA4ICAQDSAqiJKyO2WXgsL0sl6iryjEijQ/S+dnrk0ICkCiy3bZYb1b3x
23-
hHtBYN3aV93GTUCX+qypT8KXJzFSuZKKq5Hh00Hk6YhjO0hzUYvsbkfqluuj4ds7
24-
W1y+s7lUt9AM6XEfs84D1HZz/ez3vRYZ6pvS0hbO2JhEFq/4gPc0GR75K3elBiwd
25-
WYKr3Aup9A8gBED0xzSnp5fb4si873DaN68xw5e/KPvYvZFTIZxc4XWwkP4alMcw
26-
aIlajFR+szGJo4NibfiwBWRtq1yvi9wg/roRiI24kAqEh08pTxiFyq7209DjbW6a
27-
iWH/qtbzmiBxcdqshFPBjry9oxkujWnjfZ7diwMvjUz5OnOVYJHRL5LFd5bwGbpq
28-
oZZ9mv2z1srveRN7Nne8NKM94aZnPj/xBYbIvJencF5Yxh3rM6Y/nDP+5mtf/+Ks
29-
qToqFc3nvIiq7AQicR7kdjPAHjoyCMKBSYO+oNKjhtj5+QHXwToumcriESJAEFg9
30-
JmftGH5Defg90di/AUmJD60nQ1rgclt1huxpZRurSeawtemEvEorB22bPpvzEgX7
31-
xb7OSp96aoww4GQ4H7Va3uaxiNnuRPdYIis3Alf7bPw0t1A9I1XKR6cA2vSttmum
32-
1LxNJS0LKnEhMm3fy8g+TiubQYSOyT6qkUiu+J+rSwrDo1QzmvouQD+Jgg==
2+
MIIEgzCCAusCCQDsvB5Pim4CNzANBgkqhkiG9w0BAQsFADBPMR4wHAYDVQQKExVt
3+
a2NlcnQgZGV2ZWxvcG1lbnQgQ0ExEjAQBgNVBAsTCVRlcnJhZm9ybTEZMBcGA1UE
4+
AxMQbWtjZXJ0IFRlcnJhZm9ybTAgFw0yMzAzMDIwNjM0MjZaGA8yMTIzMDIwNjA2
5+
MzQyNlowNjELMAkGA1UEBhMCVVMxDTALBgNVBAMMBGNlcnQxGDAWBgkqhkiG9w0B
6+
CQEWCWNlcnRAdGVzdDCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKS2
7+
q+REopxvA3HY1zHRcNO9AcBZ3pGkVR2bSJ+awL9xZk7yjMrhqZ29XtScvs4ZUguS
8+
3i6hrsY2hUqFWgbucJSObvUc6OBYoelUmNGtzhdwcsppFdZiJSTp2h6+/cZkX+fm
9+
3xJcrTfzZVeBSniGGuzJHoJNXOaps9ilrOibm7/OZNF13NAe/VIjKPlQA1V3gdGd
10+
6MAZ0p1IUF3flA9s29bCdsDcdbD6yjIfWfvztWIEx1PbARu9pd6tmg8jc3fvkqru
11+
d/nfNb3y3rHnSITXxJg3zO8OERXHmw/lGPiJahmzXjTvsk2Qwfb8TKnwtuh7eCEo
12+
VM54hyY4kxlWKQlpPRv1D+dLzp1BlzJjJxcg+U+86OlwNIaA9+bv9Kzfsw111IOG
13+
L4CWgxV4F7iYt2CAHdygEqkLImmPpjSXGZN96Rnf3vkSlNMIHatQDIYRZHKP8bq5
14+
Ww0zIC+pflTA8s1+KfN5qccgiqAwRXv1AKqA9YYx35chljp2qdNbyBQcsnNPiyA5
15+
XDSgNGsjinKiKWy/VLv947nvgRrPv+iJTuzNyIhmdZr1dDJDPhtjWa7nMgv668e+
16+
NuAQOitQcFDN9NxjZ6CCJmw33hz0bjXESKsCvUlvfNra/DpESZ8MRKB8CoTgx0ey
17+
r72C1u/6o+qXZS3mzWdNmyzqR7mUeiRozmxqmiczAgMBAAEwDQYJKoZIhvcNAQEL
18+
BQADggGBAEf+CntVZefcgpzRNdxgpnEFh4SRiJyjUK7n2mVzd+kzk9K+E9lvJ1Ho
19+
PPIOdFRvj9rY3k+Q7G4eZL+2tNlN1KSfeRus5awp8tmFDd75kRGSkdCFWjebaq2k
20+
xvMkxp0E7v/zAN+OghF3ek7JLGQC4e4gCiyYDdB/Rvq3zEex471riqQu8vbs0CCV
21+
rz8d0NBSWc2XRKFRhLjODhDTLkLnJjIKW7863iFxXxYGHw4ngIXuctXN+QzRuX2r
22+
OioQSkmmtcmDwugDCX8YcHxZQgqz5+FthO76MugBTcgyBJK4UrJlyW56RZ6orLf3
23+
527ZRRzWNd2xXMkcXQaneVvqhWydXfk2+vShN+iaU4GMZANP+d+imZuNyHHJKZcP
24+
CjQJbSQfO3cupfddXUuhEYoCE9WA8GNOWKWBbdyG1gQDyrINCU7XpH0sNH9Sbukz
25+
iobq+k9KqwClkUOpVr6OIFjmh0s1hdIY3qVa8OVp5Y687FcIGzE/euDqsoFMvkEL
26+
BIQP07pT0Q==
3327
-----END CERTIFICATE-----

‎govcd/test-resources/key.pem

+52-54
Original file line numberDiff line numberDiff line change
@@ -1,54 +1,52 @@
1-
-----BEGIN ENCRYPTED PRIVATE KEY-----
2-
MIIJnDBOBgkqhkiG9w0BBQ0wQTApBgkqhkiG9w0BBQwwHAQIyZJXaPnPUVgCAggA
3-
MAwGCCqGSIb3DQIJBQAwFAYIKoZIhvcNAwcECMwPqNNhiaSbBIIJSHGxsPf33TZn
4-
xUbOZJcoRk7DNxnUMwNgbUnK+WL213AU0IAaJ5qMsNO8dwk8oOSkNs2K66h9ZGUI
5-
8GXP/76ndkZEbNy6Xk2Uu7PI+mGSItAQBLdG8izPgYALlEVscqRbDb4NP2v9H7Eu
6-
oJFvLuxL2xxjC8QL1R/MKqo4ZllKoCxzwdE949UPViPbpm49wMgUOEeS8Kwv0N/1
7-
HI8o7+KI5enPaIYUjQF6HdkZtcJ/zcMbNzdMNfPfQljBHl1KmGQfVV92Vaoa+E9a
8-
bj4vf1PUd2Y4QCLhT8yxEYHSm4x7szky3ecsA2lLZPluuEKQOmDdcC596wCQ4Mmv
9-
/p32xpzuT4eoDBeDHPCM2AdJl/lXFEgdvZQrNUsYGHHhf79aEsZbbREHVxMkcSPz
10-
3K0IoWAPf3c3zTtG9MJEHLZavwBuGOu5xHIXnL6VIOWHvok/lhNPGbE6azXVTXjD
11-
9tXV/478GDa5XnGxOzBrsIIWGqf0OMbySG2YIIr7g7BhsQpVVOgCQE3UsVMtWrud
12-
UUXC68kdreT37V1zDkqpHyUHydvx1eSDAdJHmhnEYW+Dolk80IhfZcYUKEDQEO0z
13-
nIdfcNjYgKljyvqHRADoK+eNV6p75KMDY5f/E4bGxpirrrijj6duFm+dtDTWNtIm
14-
RgOj/eLrshbgxRr0GBZSupu0tN86+/TuL/OK9L3yWbJJ1vv+vwGisKysiy2m0D7q
15-
KnTDK9hpSFOJg2MY7DWgaKl/qAXHgjG3YPfP0T69FYX/mf1tfjwwd3f4GfBdUPus
16-
7RQJ6nZlk23ajrbvQBYF9KRCelQhVd81h3puSWc2Ip9IVvxb8eZ9s0gGpCBTGj9o
17-
SFHPStYA8U0h5JEJOkHniy3apytjVmYa+CWBglLF6R+EEDSwZKDsZhWBozxPpUuC
18-
9p7Lyqj3syJUdfnoCj8jcqWq3dIbWrjsWaKQLVJJW2uNrdNQS7hJpgSaug3qBkFG
19-
I4hdK+gszYH9qTRrfAXcgqo4wGEELc0eCXhrHETrD98GGT7UpYzONxQ1wYOJ5u+f
20-
OpTpb2pap08KihLBq4cdwi+S+6alWjEqDPxaZ/4cS2FZCPX/JcghOydEWeH8IarO
21-
V/iT7wXF4b5yw/SfLq0bsHS8hiGuq9HE3QQrj+1b1Q0I2pxec3Kjvrqd3GUJjk5p
22-
+MysONs2LGQu8+j8EHodQZjfSpjNmGhqXA7ligmNvfHayT4925xrZZfajUsl8dOO
23-
a6yNQ6uXUd65JpQz8JOSPqgfhH7IPTSyRgQA9zltkt69w79E370n1cCz15/ujsm6
24-
JRJsD1519NZhXDOanx5BBQdlMqp+1CsAZNbKMKv4H9hwVJnN+sudOPIXB7cGeeVs
25-
+xOZsLlw9MgJNOvjbVsFdhduQINcWiKtLkOWST0cZD5uFtvRPpZGvYCQvkbIN8BT
26-
Qs7J21MFtpmodMLK1AIu3jQJrUScpVGgvsleP/esmibnhi5wO571DT1fDqLXm4aV
27-
DodEAejG6UgMF2oxK3x5wuVxI6NZYZYjS+PB7HhaFKnRBf5IuFmk+MYJWab9Md+r
28-
C99Ra/l8SeGmrSw5q1wsUUw6rFOi4hn2jm7u8/oqc2h1z1chmAOQyqaM3Fp0PZRp
29-
ZO6rMRjSWDRBNrpZU1dEAFxbQ8vsWtkvX07Ov3vSpXUHKg229BFAKAsOnUAhu8MI
30-
8dT+k5AlTjmRq5NoeLhqkcN+SWYaIe6A46pCY8sDJPs1XUR/dbQVZLcaQCSkcVZQ
31-
VhAy3t1f2GY8vfCZrW6z4C5v0Zj/Vt/JtkClr8EEkGKuwuPHgca1a7wXXmVA/P4G
32-
meigHEE6WHIkbjZu6uq2pn4KxhZLhUWg3EXewOQWxNpWzPac8lE5W2/w/tsAb6+o
33-
xtixRCjAOxin8hJP72aL/kmbBKfrH/8Wkh7uusWSLvJ+iSYOBYRUZ7TKW7nuasXx
34-
hk3aw7SCEHBkjSU+hmUjaren08R6Cja2usgmIXZPwnO1gTsn8f39CnIlJQ6XbxN+
35-
IuzHWnY45ihadez6JHfxTbT09hlaO04ojlBLhEyNHJF0r2+LGOcJqGz6SZEHoc4n
36-
21EGZ4uN6wVZep8Y+telu3h5rBEKc+gV4S8qOCHPkdb9aavCrD+OowVQh4QIHGEr
37-
m17oGAyBg184DLQvDc4680wGR2R9av3aDs7CK396pVmBx/OBwTODCejJ3t7NT3DS
38-
+X5P35zNNM6WMZknWRJk9i3kT4NL7kBx0j30o7J4pKnhtW2VLDekaDPp25eqkRLw
39-
c3re0lcpJF88OqUrH46o7t6XiuXWkFmoJYKqUEqemWiXX94NHpnzROpIk03Td9Mj
40-
9dQI+KdqjWSazhYQSulbOAU9k4N5IiZgB4tsPY2vZs9iowIrw/BIZrmChx3d63Od
41-
8uAHN3hldPN2Myqe0p7DA7V0p9Nr4qqM0JbeG7EEDf4XjgeytLYWRm5TJmNBiqA1
42-
40IWIqHcjQpqf6eD0RzxO0mcy4ZoeIU7dXMzdNsqg66yxRGynHmkKinrwoqsADV9
43-
gEWVdPqsSgNLycpcuGcOsdH1lTMDovrHvLzOnk8nT/F1LgH2czzRxHcrx2/2Zm60
44-
nkZ/sU5FKVAE7imuUbYyKRm6tXxLx7a/NNtac51GgcNXC808ycO2KdNJpqsgO6Ub
45-
1apZe3+WxyiWSRMaQ+Dw7GlR4ZXgdtQTAniDe8I3Be8ZI1uHQtth+IN9mA9CLIb6
46-
9qQy3eOo5Ip4RIVTdOX3rVGOzOPD57T2K4Cg2XDgWC8g2o+X6Sgv0orwwoqR1QWa
47-
HN6VOc82KonKAdo1ctnrxWq7JodhQOqZvFRBxvRV9Rdww/GKKE8q0PHYBGNfGAXY
48-
MC9vflAFIRTaiNTGkmpUwWg0iTaXGu2dVCO/4yTUBVcfubzPacXFocxU0zcEk/ll
49-
M2yoil/kfRu8JZav9/RZpxLZMz5c32We3xePnDUcSpFYhFdF8MILLc8YaRZ6xRRT
50-
hwQb1w9x0YvrtUqEE1k8UmSKP0P+H4LfunGp6uTU2zOTHulHQe2VCaARuRO6K3HG
51-
lDT9qQZ7HVxF+4vuLPMv5pFwjVoxi4LK9NBL0bJ1VoaSQ/uqOjYxdv00bo1gb9I4
52-
fdRskEjVssBI4Aie5ml/CShML1Unys6hLtvmsY+5pFcXRhgoPRPJDVghkqqe7rJh
53-
X/zTeUPmGZPiLyL4CMCPoQ==
54-
-----END ENCRYPTED PRIVATE KEY-----
1+
-----BEGIN PRIVATE KEY-----
2+
MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQCktqvkRKKcbwNx
3+
2Ncx0XDTvQHAWd6RpFUdm0ifmsC/cWZO8ozK4amdvV7UnL7OGVILkt4uoa7GNoVK
4+
hVoG7nCUjm71HOjgWKHpVJjRrc4XcHLKaRXWYiUk6doevv3GZF/n5t8SXK0382VX
5+
gUp4hhrsyR6CTVzmqbPYpazom5u/zmTRddzQHv1SIyj5UANVd4HRnejAGdKdSFBd
6+
35QPbNvWwnbA3HWw+soyH1n787ViBMdT2wEbvaXerZoPI3N375Kq7nf53zW98t6x
7+
50iE18SYN8zvDhEVx5sP5Rj4iWoZs14077JNkMH2/Eyp8Lboe3ghKFTOeIcmOJMZ
8+
VikJaT0b9Q/nS86dQZcyYycXIPlPvOjpcDSGgPfm7/Ss37MNddSDhi+AloMVeBe4
9+
mLdggB3coBKpCyJpj6Y0lxmTfekZ3975EpTTCB2rUAyGEWRyj/G6uVsNMyAvqX5U
10+
wPLNfinzeanHIIqgMEV79QCqgPWGMd+XIZY6dqnTW8gUHLJzT4sgOVw0oDRrI4py
11+
oilsv1S7/eO574Eaz7/oiU7szciIZnWa9XQyQz4bY1mu5zIL+uvHvjbgEDorUHBQ
12+
zfTcY2eggiZsN94c9G41xEirAr1Jb3za2vw6REmfDESgfAqE4MdHsq+9gtbv+qPq
13+
l2Ut5s1nTZss6ke5lHokaM5saponMwIDAQABAoICAELFRmMvq5esrQHOvFWWqJ09
14+
BmO6Sq5Rpqts0oDY1AAHcUjZrFdmKUMnjDS2IeccfpTwgZ73rgjt+xSdgERFDmA6
15+
aSJ2CLVBWMlkoNqHEX+Q9we0l8SjXplbLy+9jtSIxhQVFCK2bQW8Zj2VzOGUw39v
16+
fC2oPNvIuX4+kxxsUDPt8BK1K8E2fsx4Mlj2pZNU8cxOrhaJoUZfFS0owDWMlIW3
17+
qTo/ZHpNAABXkzu+rK3CcCc/JXDgbUgaqdQvM9TPym3+Y6ZoZLnOpZYKwuwPJ8Pp
18+
Aut5kVV56BMGdRvzYI5wluTwsiAdaXO9DTrquMr/mlAesFpOo8LLtl3T/qiw/7MZ
19+
4AV8E4uYSxkLL7fAfec9CbOoO3sup1imM8JTMxx0gRuJBn6wi82NtDhd2q2qfFbO
20+
hgZIP5GwIUGDMwZMz1CniGKiUGKz/YkKo7qXF4MewQadBGmfUDuRoCQ/j9QcdvAF
21+
cJ+OsvrC7T3XLiD/GegJuw/cBX281bCoLYItA7F9+CA4RuLpIxphUH4ITqhbtvtJ
22+
XCECXYcYQN0LOPhw9BbtsVV/pYoQ2CWNmFRWZADw03rpSWVChMbnDUfI6QAbMx8g
23+
pyVNll75Eb6+FHDOVaMIfIL6yDlMKrGSVjsvgWKN5pL+zqb4kLTUGiQZXyLrgDUJ
24+
TJ1K8qYPxJx2r+Jga34xAoIBAQDZZzyLgvHR1J842LAR5EpgR9AyEQMbx4zhfP0p
25+
r3GoxVYKxfiA0bpD02dc+D18Q2I9RtCnfTkKsk5IZXxRN7MzfyPqh34ztazUPszg
26+
/9O/RLFHWSPUPq4C/HmrA+dPiZ9V0s5eL/CIsvqSczcRkEkwj4TEY/ERTI4hbunJ
27+
mOSase4Cmx1T1wvtx1USiuBYErCf8laxM0R95aiKX+YNwM8nzWmy2UD2+JOvMsMn
28+
MZFlj8QiE87C9Fbpq90ePwYoKz7azOw3ATRzgi5/ScYzSDlTlsEMasvy4D8+l+XL
29+
bY50nquZ9YdER+t2/bj1BzoVR9Kf5eiecW/mZREW35EtgxAbAoIBAQDB9L1n0UHF
30+
A0l+xKp9Xp+YsO761G+mV67eD9f2BZ3ATi/rMJDzENub2zAOTYD+V3HZiGoQWl3S
31+
Nv+nyIOZwdD9LASnv5QE4fngO3wqd0YOJIUamVNl+XGFZpPUiGdtWzRxidDwqOWx
32+
uoapVFE5nigqehQ+BUKKps7Ihq61cj4Q3czjJrNzHuMTKRSXgSvlI703MUfQhAkL
33+
u05N8um1ORv8sinyVj2VIxjGwqO5Nv8IN3ecSceipcMFC/tKy10Q82oWX4Xf0IVC
34+
DzEosWR1+RUZaFFCZBozlB9C10bgjnM+owlMQSqaGpnkwuDcOCg7cwRCOziQVJZD
35+
VnQe3lIE06bJAoIBAQCZ4YzlYwYvc8RPxHC7+U7731jqV0hP/WsmoAXB38EfqK5C
36+
aeZ/p/Oj1psvHzbGIhwDK4C9TNF3VMY8UDkyc66QIMoXU1hs2Yc/pEP4bpw+oiyp
37+
R9sofEVHL9YeymCL1+nEIbaYzG4BFE5wIsUz1WE40h0ztVoI2Jsx5wPsAiCtrou9
38+
pHWZxnlXEOSSf2JUdMY4MJxUSOmOA2TMrRx1V6hJkAfk5Aorxb8jH1crAtbbgGtf
39+
g42ySKjMNS4KHqoI/LM8xBfexyeNKvQmfN2hptmM5QQ3+c/qVffuIi4xU5alzTnB
40+
fB0Go7FzRBwKs9bVAUWAkIeavshp19fEzPJBuKdJAoIBAG5Tp/XJC29kykao2g4M
41+
aB4z7wyREJ1/XQIF4yOX2D8OeqV+78TDvxft220XWxvSY/mIZkS9EodEL7KiFXG9
42+
1QJeKpu9Fxab8EZDsAJ77EaZMXmK4+yqso9eZRLNMH/9FFzNNyPd/yJU5sqlIrry
43+
owhefus0lMBH2HIqYnDl9jYj5KsFVahTVnmMsaDooi5qYPRnPOF4aajZt9YRKi2i
44+
ua/JLKEju039M9fD2du+U925p3koYr27Kq7RPPUzrtG4lIz7cyx38YU9HQp3tZyB
45+
viXAuBBa3qieRhYAXNnZTebAWMaefvw/y3BcBgpei0wdxbti8m7vHrZZFB6G+gKy
46+
3jkCggEBAJZzYmGvjlDumPElX3hzzAjPMhz3CmoyGC6aJN05ezK/z3iOG9CGJLcG
47+
vyU3yD/iEy2TbQtPjrVz+HMBF0Zs7FAK9XKNj20TCu0tOKIUa7KWTaKJjbn7qg0q
48+
k3v09Pj/ZevPrdNL4DKGLCbgsTJLGZK+HSE3jJ/SPSNHuoOaRetpsJtMcjJgDmqr
49+
URs3t0xNZt6zRR9/1SrAmVCBrJpMuiPQNgJJppx+jw6d8FUTHqp4iyfX190UeJV8
50+
X/g4SS47VcjjJBJMKyMmZl+D8p32wuc4YE99/ycZdLpUxVhla5Q1alKIj5bUc0o+
51+
8YHtmZ19oGLMOCHqJ8T4bvoSYGTi+8c=
52+
-----END PRIVATE KEY-----

‎govcd/test-resources/rootCA.pem

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIEbzCCAtegAwIBAgIQYl7uyKCXFwpi+qNH8QN6pTANBgkqhkiG9w0BAQsFADBP
3+
MR4wHAYDVQQKExVta2NlcnQgZGV2ZWxvcG1lbnQgQ0ExEjAQBgNVBAsTCVRlcnJh
4+
Zm9ybTEZMBcGA1UEAxMQbWtjZXJ0IFRlcnJhZm9ybTAgFw0yMzAzMDIwNjE4MDNa
5+
GA8zMTIzMDMwMjA2MTgwM1owTzEeMBwGA1UEChMVbWtjZXJ0IGRldmVsb3BtZW50
6+
IENBMRIwEAYDVQQLEwlUZXJyYWZvcm0xGTAXBgNVBAMTEG1rY2VydCBUZXJyYWZv
7+
cm0wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCwlYSqjG7xrleLkO2D
8+
aOB3Z2cZQH1XCLFD//o8ctIDY1mmvlthlZ47H8FOpbI9/O+40oon27XmBxPCuYyy
9+
+/ZbmdBf4QB3BBcGGxhR8gInuCT65rraoAeLSRqNOwYcPduRBvrdNeCj2vyK98kR
10+
4U8M+K64nx0hQlusu6Cyd5KiOyKg6CuoXnBKWZ1W2s8En23SIaxg+rydPM/jtjmW
11+
G6ArF2TtzuBPZ/z0rqroHw2Kwtna5r6mTaW9u4EKIaPyWn1Ay7iFABIs6DS/BEiS
12+
xnZHeXTqRD32HnMKXawrG0Fm++MX1c+qA2/k5JM2CF2BtoPbnekK7gWj38JHSrNg
13+
YLafYkMA5d/eTR8EnrGLGvHUTRQwK8CpG1bHRJSdbDwhvgQxgjLpcbeZzv+g42v8
14+
vXaXImDZEhiLeMIDM4XphyfH3l2W0WztqBM1GlM3Ycf9LvISqTH5z9QRM3JX0mRS
15+
xYFfCb8XC7vWaWkWoIHJ5RYQ6tHZ8wTtrvO34qtEAVSIte0CAwEAAaNFMEMwDgYD
16+
VR0PAQH/BAQDAgIEMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFNA4nzDg
17+
xEjwbJXhr47p/mub8cKEMA0GCSqGSIb3DQEBCwUAA4IBgQAyg+3HGr4dUnEJXpk3
18+
FocS0Bup2ds+wREejACEIgP1PzbcdJpHG4Qswt/6FvIRAzH84nGucZVeWdRI7jOk
19+
qT5I8nOQ/UTlZkEnt5QBIQX/ghg77mQrRY6neeI99NRm/28k9SERrpfpJStLeDwH
20+
jNnAGkfSxZP1QZACebrTPFAY8vGGGIDZ1ZeUwxJgfbrD9dF5cTJYftSwOndQVeKS
21+
SeRBsgwe7NLCmLzQOlmlo83KoGoGd6n9P7vTtB8Uj8WPv7O12+XTNjv8CuWR1Zhq
22+
LERLEBwtHd6POAjSvi1/58UKRJIPqa04dCSCGRrF5eeJVAzP3IiFWZz0aGZNj/gW
23+
Ynp8DVyF5ur5fGrA9Ao5r12avoYMnqzbgRPTY/u55Ab1SowU4xLbSzTGmD/Msg3s
24+
A2+dDBPQn3+6z88TZSVFKy/t83qXM156YMpgk2f37yIxHcPp+MJNNxKp1GzkrCXJ
25+
uo41rJCOGpVx/gWXsG+DKr0ZITWf5/oQF6AsWWxIIfaUEjU=
26+
-----END CERTIFICATE-----

‎types/v56/constants.go

+6
Original file line numberDiff line numberDiff line change
@@ -584,3 +584,9 @@ var NsxvProtocolCodes = map[string]int{
584584
DFWProtocolUdp: 17,
585585
DFWProtocolIcmp: 1,
586586
}
587+
588+
// NSX-T IPSec VPN authentication modes
589+
const (
590+
NsxtIpSecVpnAuthenticationModePSK = "PSK"
591+
NsxtIpSecVpnAuthenticationModeCertificate = "CERTIFICATE"
592+
)

‎types/v56/nsxt_types.go

+19-4
Original file line numberDiff line numberDiff line change
@@ -585,6 +585,15 @@ type NsxtIpSecVpnTunnel struct {
585585
// Note. Up to version 10.3 VCD only supports INITIATOR
586586
ConnectorInitiationMode string `json:"connectorInitiationMode,omitempty"`
587587

588+
// CertificateRef points server certificate which will be used to secure the tunnel's local
589+
// endpoint. The certificate must be the end-entity certificate (leaf) for the local endpoint.
590+
CertificateRef *OpenApiReference `json:"certificateRef,omitempty"`
591+
592+
// CaCertificateRef points to certificate authority used to verify the remote endpoint's
593+
// certificate. The selected CA must be a root or intermediate CA. The selected CA should be
594+
// able to directly verify the remote endpoint's certificate.
595+
CaCertificateRef *OpenApiReference `json:"caCertificateRef,omitempty"`
596+
588597
// Version of IPsec VPN Tunnel configuration. Must not be set when creating, but required for updates
589598
Version *struct {
590599
// Version is incremented after each update
@@ -607,10 +616,16 @@ type NsxtIpSecVpnTunnelLocalEndpoint struct {
607616

608617
// NsxtIpSecVpnTunnelRemoteEndpoint corresponds to the device on the remote site terminating the VPN tunnel
609618
type NsxtIpSecVpnTunnelRemoteEndpoint struct {
610-
// RemoteId is needed to uniquely identify the peer site. If this tunnel is using PSK authentication,
611-
// the Remote ID is the public IP Address of the remote device terminating the VPN Tunnel. When NAT is configured on
612-
// the Remote ID, enter the private IP Address of the Remote Site. If the remote ID is not set, VCD will set the
613-
// remote ID to the remote address.
619+
// This Remote ID is needed to uniquely identify the peer site. If the remote ID is not set, it
620+
// will default to the remote IP address. The requirement for remote id depends on the
621+
// authentication mode for the tunnel:
622+
// * PSK - The Remote ID is the public IP Address of the remote device terminating the VPN
623+
// Tunnel. When NAT is configured on the Remote ID, enter the private IP Address of the Remote
624+
// Site.
625+
// * CERTIFICATE - The remote ID needs to match the certificate SAN (Subject Alternative Name)
626+
// if available. If the remote certificate does not contain a SAN, the remote ID must match the
627+
// the distinguished name of the certificate used to secure the remote endpoint (for example,
628+
// C=US,ST=Massachusetts,O=VMware,OU=VCD,CN=Edge1).
614629
RemoteId string `json:"remoteId,omitempty"`
615630
// RemoteAddress is IPv4 Address of the remote endpoint on the remote site. This is the Public IPv4 Address of the
616631
// remote device terminating the IPsec VPN Tunnel connection. This is required

0 commit comments

Comments
 (0)