# Generated by Ansible.
# This contains the Opportunistic IPSEC configuration from this node's
# in the {{ network }} to every other node. This also uses a private
# policy, which will hold packages and drop them if negotiation fails.
conn overcloud-private-{{ network }}-ip
        type=tunnel
        authby=null
        leftid=%null
        rightid=%null
        left={{ current_ip }}
        right=%opportunisticgroup
        negotiationshunt=hold
        failureshunt=drop
        ikev2=insist
        auto=start
        keyingtries=1
        retransmit-timeout=2s
        # To support being behind NAT
        leftmodecfgclient=yes
        leftcat=yes
        narrowing=yes
{% for other_ip in other_ips %}

conn overcloud-{{ network }}-node-to-node-{{ loop.index0 }}
        type=tunnel
        authby=null
        leftid=%null
        rightid=%null
        left={{ current_ip }}
        right={{ other_ip }}
        negotiationshunt=hold
        failureshunt=drop
        ikev2=insist
        auto=start
        keyingtries=1
        retransmit-timeout=2s
        # To support being behind NAT
        leftmodecfgclient=yes
        leftcat=yes
        narrowing=yes
{% endfor %}
