Unsupported VPN Settings

[arjenvri]

Morning,

would it be possible to start supporting these additional settings for SRX VPN configuration?

thank you!
Arjen

set security ike traceoptions file kmd 
set security ike traceoptions file size 1024768
set security ike traceoptions file files 10
set security ike traceoptions flag all

set security ipsec vpn vpn-ipsec df-bit clear
set security ike gateway vpn-gw dead-peer-detection always-send

[jeremmfr]

Hi,

• security ike traceoptions parameters can't be defined as an object (parameters block differentiable with a unique identifier such as a 'name', 'address', a pair 'route' / 'instance', ...) as required by a Terraform resource.
  You need to use another method to add this configuration.
• df-bit clear can be defined in resource security_ipsec_vpn :

resource junos_security_ipsec_vpn "vpn-ipsec" {
  name = "vpn-ipsec"
  df_bit = "clear"
  ike {
  ...
  }
}

• For dead-peer-detection always-send, I must add the option on resource junos_security_ike_gateway, upcoming PR.

[tagur87]

@jeremmfr -
I have done some more research on what you have mentioned in this and another past issue related to how certain settings(system services ssh & security ike traceoptions) are not able to be configured in terraform because they can't be defined as an object.

I understand the issue, specifically on how there is no unique ID that can be used to identify the object of these settings, and thus we don't have anything to be able to identify the resource "ID" in the state.

I dug into some code from other firewall providers that I am familiar with, and that have similar "settings" that don't work as an object, and it seems there is a pattern that they use to deal with this issue.

Please take a look at the examples below. Both of these resources seem to be similar to how the junos settings system services ssh and security ike traceoptions would need to be configured to work with terraform.

https://github.com/CheckPointSW/terraform-provider-checkpoint/blob/master/checkpoint/resource_checkpoint_management_command_set_api_settings.go#L49

https://github.com/fortinetdev/terraform-provider-fortios/blob/1c670dc9ea42605cde9a763bea460169328c1a52/fortios/resource_firewall_policy.go#L961

I have started to do a proof of concept locally to see what I can come up with, but I wanted to start the dialog to see your thoughts on the above.

Let me know what you think!

Thanks!

[jeremmfr]

@jeremmfr -
I have done some more research on what you have mentioned in this and another past issue related to how certain settings(system services ssh & security ike traceoptions) are not able to be configured in terraform because they can't be defined as an object.

I understand the issue, specifically on how there is no unique ID that can be used to identify the object of these settings, and thus we don't have anything to be able to identify the resource "ID" in the state.

I dug into some code from other firewall providers that I am familiar with, and that have similar "settings" that don't work as an object, and it seems there is a pattern that they use to deal with this issue.

Please take a look at the examples below. Both of these resources seem to be similar to how the junos settings system services ssh and security ike traceoptions would need to be configured to work with terraform.

https://github.com/CheckPointSW/terraform-provider-checkpoint/blob/master/checkpoint/resource_checkpoint_management_command_set_api_settings.go#L49

https://github.com/fortinetdev/terraform-provider-fortios/blob/1c670dc9ea42605cde9a763bea460169328c1a52/fortios/resource_firewall_policy.go#L961

I have started to do a proof of concept locally to see what I can come up with, but I wanted to start the dialog to see your thoughts on the above.

Let me know what you think!

Thanks!

Hi,

It's not juste the ID, it's the concept of terraform resource is an object than can be create/updated/deleted.

But yes I can create a special resource for configure a part of static configuration (not a object) of Junos device.
This special resource have to be created once otherwise there will be the conflicts. Deleting this resource will cause no action.
I will take care of creating this special resource and including parts of configuration requested in issues #26 and #33

Best regards

[jeremmfr]

Look release v1.6.0 for your issue