diff --git a/usr/local/www/vpn_ipsec_mobile.php b/usr/local/www/vpn_ipsec_mobile.php index 1c58c80601..fc0fbaaefa 100755 --- a/usr/local/www/vpn_ipsec_mobile.php +++ b/usr/local/www/vpn_ipsec_mobile.php @@ -283,6 +283,7 @@ function login_banner_change() {
+ Please click Create to define one.","create","Create Phase1"); + if ($input_errors) + print_input_errors($input_errors); ?> - + -
@@ -308,9 +311,9 @@ function login_banner_change() {
-
- +
+
+
IKE Extensions diff --git a/usr/local/www/vpn_ipsec_phase1.php b/usr/local/www/vpn_ipsec_phase1.php index 21b3f3c8b8..a47d90d7a2 100644 --- a/usr/local/www/vpn_ipsec_phase1.php +++ b/usr/local/www/vpn_ipsec_phase1.php @@ -357,18 +357,18 @@ function myidsel_change() { index = document.iform.myid_type.selectedIndex; value = document.iform.myid_type.options[index].value; if (value == 'myaddress') - document.iform.myid_data.style.visibility = 'hidden'; + document.getElementById('myid_data').style.visibility = 'hidden'; else - document.iform.myid_data.style.visibility = 'visible'; + document.getElementById('myid_data').style.visibility = 'visible'; } function peeridsel_change() { index = document.iform.peerid_type.selectedIndex; value = document.iform.peerid_type.options[index].value; if (value == 'peeraddress') - document.iform.peerid_data.style.visibility = 'hidden'; + document.getElementById('peerid_data').style.visibility = 'hidden'; else - document.iform.peerid_data.style.visibility = 'visible'; + document.getElementById('peerid_data').style.visibility = 'visible'; } function methodsel_change() { @@ -377,23 +377,23 @@ function methodsel_change() { switch (value) { case 'hybrid_rsa_server': - document.iform.pskey.disabled = 1; - document.iform.privatekey.disabled = 0; - document.iform.cert.disabled = 0; - document.iform.peercert.disabled = 1; + document.getElementById('opt_psk').style.display = 'none'; + document.getElementById('opt_my_cert').style.display = ''; + document.getElementById('opt_my_pkey').style.display = ''; + document.getElementById('opt_peer_cert').style.display = 'none'; break; case 'xauth_rsa_server': case 'rsasig': - document.iform.pskey.disabled = 1; - document.iform.privatekey.disabled = 0; - document.iform.cert.disabled = 0; - document.iform.peercert.disabled = 0; + document.getElementById('opt_psk').style.display = 'none'; + document.getElementById('opt_my_cert').style.display = ''; + document.getElementById('opt_my_pkey').style.display = ''; + document.getElementById('opt_peer_cert').style.display = ''; break; default: /* psk modes*/ - document.iform.pskey.disabled = 0; - document.iform.privatekey.disabled = 1; - document.iform.cert.disabled = 1; - document.iform.peercert.disabled = 1; + document.getElementById('opt_psk').style.display = ''; + document.getElementById('opt_my_cert').style.display = 'none'; + document.getElementById('opt_my_pkey').style.display = 'none'; + document.getElementById('opt_peer_cert').style.display = 'none'; break; } } @@ -433,13 +433,10 @@ function ealgosel_change(bits) { } function dpdchkbox_change() { - if( document.iform.dpd_enable.checked ) { - document.iform.dpd_delay.disabled = 0; - document.iform.dpd_maxfail.disabled = 0; - } else { - document.iform.dpd_delay.disabled = 1; - document.iform.dpd_maxfail.disabled = 1; - } + if( document.iform.dpd_enable.checked ) + document.getElementById('opt_dpd').style.display = ''; + else + document.getElementById('opt_dpd').style.display = 'none'; if (!document.iform.dpd_delay.value) document.iform.dpd_delay.value = "10"; @@ -450,280 +447,332 @@ function dpdchkbox_change() { //--> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
General information
Disabled - > - Disable this phase1 entry
- Set this option to disable this phase1 without - removing it from the list. - -
Interface -
- Select the interface for the local endpoint of this phase1 entry. -
Remote gateway - -
- Enter the public IP address or host name of the remote gateway -
Description - -
You may enter a description here - for your reference (not parsed). -
Phase 1 proposal - (Authentication) -
Negotiation mode -
Aggressive is more flexible, but less secure. -
My identifier - - -
Peer identifier - - -
Encryption algorithm - - -
Hash algorithm - -
- - Must match the setting chosen on the remote side. - -
DH key group - -
- - 1 = 768 bit, 2 = 1024 bit, 5 = 1536 bit -
- Must match the setting chosen on the remote side. - -
Lifetime - - seconds -
Authentication method - -
- Must match the setting chosen on the remote side. -
Pre-Shared Key - -
My Certificate - -
- Paste a certificate in X.509 PEM format here.
My Private Key - -
- Paste an RSA private key in PEM format here. -
Peer certificate - -
- Paste the peer X.509 certificate in PEM format here.
- Leave this blank if you want to use a CA certificate for identity validation. -
Advanced Options
NAT Traversal - -
- - Set this option to enable the use of NAT-T (i.e. the encapsulation of ESP in UDP packets) if needed, - which can help with clients that are behind restrictive firewalls. - -
Dead Peer Detection - onClick="dpdchkbox_change()"> - Enable DPD
-
- - seconds
- Delay between requesting peer acknowledgement.
-
- - retries
- Number consecutive failures allowed before disconnect.
-
Automatically ping host - - IP address -
  - - - - - - - - -
+ + + + + + + + + + + + +
+ +
+
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
General information
Disabled + > + Disable this phase1 entry
+ + Set this option to disable this phase1 without + removing it from the list. + +
Interface + +
+ Select the interface for the local endpoint of this phase1 entry. +
Remote gateway + +
+ Enter the public IP address or host name of the remote gateway +
Description + +
+ + You may enter a description here + for your reference (not parsed). + +
+ Phase 1 proposal (Authentication) +
Negotiation mode +
Aggressive is more flexible, but less secure. +
My identifier + + +
Peer identifier + + +
Encryption algorithm + + +
Hash algorithm + +
+ + Must match the setting chosen on the remote side. + +
DH key group + +
+ + 1 = 768 bit, 2 = 1024 bit, 5 = 1536 bit +
+ Must match the setting chosen on the remote side. + +
Lifetime + + seconds +
Authentication method + +
+ + Must match the setting chosen on the remote side. + +
Pre-Shared Key + + +
My Certificate + +
+ Paste a certificate in X.509 PEM format here. +
My Private Key + +
+ Paste an RSA private key in PEM format here. +
Peer Certificate + +
+ Paste the peer X.509 certificate in PEM format here.
+ Leave this blank if you want to use a CA certificate for identity validation. +
Advanced Options
NAT Traversal + +
+ + Set this option to enable the use of NAT-T (i.e. the encapsulation of ESP in UDP packets) if needed, + which can help with clients that are behind restrictive firewalls. + +
Dead Peer Detection + onClick="dpdchkbox_change()"> + Enable DPD
+
+
+ + seconds
+ + Delay between requesting peer acknowledgement. +
+
+ + retries
+ + Number consecutive failures allowed before disconnect. + +
+
+
Automatically ping host + + IP address +
  + + + + + + + + +
+
+
+ - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +
Mode Tunnel
Disabled - > - Disable this phase2 entry
- Set this option to disable this phase2 entry without - removing it from the list. - -
Local Network - - - - - - - - - - - -
Type:   - -
Address:   - - / - -
-
Remote Network - - - - - - - - - - - -
Type:   - -
Address:   - - / - -
-
Description - -
You may enter a description here - for your reference (not parsed). -
Phase 2 proposal - (SA/Key Exchange) -
Protocol - -
- ESP is encryption, AH is authentication only -
Encryption algorithms - - $algodata): - $checked = ''; - if (in_array($algo,$pconfig['ealgos'])) - $checked = " checked"; - ?> - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
- > + + + + + + + + + + + - - - - - - - - + + + + + + + + + + + + - - - - - - - - - - -
+ +
+
+ + + + + + + + - - - - -
Mode Tunnel
Disabled + > + Disable this phase2 entry +
+ Set this option to disable this phase2 entry without + removing it from the list. + 		- - - -    - - -
-
- Hint: use 3DES for best compatibility or if you have a hardware - crypto accelerator card. Blowfish is usually the fastest in - software encryption. -
Hash algorithms - $algoname): ?> - > - -
- -
PFS key group - - -
- 1 = 768 bit, 2 = 1024 bit, 5 = 1536 bit - - - -
- Set globally in mobile client options +
Local Network + + + + + + + + + + + +
Type:   + +
Address:   + + / + +
+
Remote Network + + + + + + + + + + + +
Type:   + +
Address:   + + / + +
+
Lifetime - - seconds -
  - - - - - - - - - -
+ +
Description + +
+ + You may enter a description here + for your reference (not parsed). + +
+ Phase 2 proposal (SA/Key Exchange) +
Protocol + +
+ + ESP is encryption, AH is authentication only + +
Encryption algorithms + + $algodata): + $checked = ''; + if (in_array($algo,$pconfig['ealgos'])) + $checked = " checked"; + ?> + + + + + + + + +
+ > + + + + +    + + +
+
+ Hint: use 3DES for best compatibility or if you have a hardware + crypto accelerator card. Blowfish is usually the fastest in + software encryption. +
Hash algorithms + $algoname): ?> + > + +
+ +
PFS key group + + +
+ + + 1 = 768 bit, 2 = 1024 bit, 5 = 1536 bit + + + + + + + +
+ Set globally in mobile client options + +
Lifetime + + seconds +
  + + + + + + + + + +
+ +