unity plugin¶

The unity plugin provides support for parts of the IKEv1 Cisco Unity Extensions.

To enable the plugin, add

--enable-unity

to the ./configure options.

It is available since 5.0.1.

Client Behavior¶

As client, the IKEv1 daemon charon will narrow traffic selectors to the received Split-Include attributes and will automatically install
IPsec bypass policies for received Local-LAN attributes.

Server Behavior¶

As server, charon will send Split-Include attributes for leftsubnet definitions containing multiple subnets to Unity-aware clients.

Unity-attributes may otherwise be assigned via the attr or attr-sql plugins.

Configuration¶

Key	Default	Description
charon.cisco_unity	no	Send Cisco Unity vendor ID payload in main or aggressive mode (this option is also available in versions before 5.0.1)

On a server the subnets listed in leftsubnet will be transmitted as Split-Include attributes to clients during Mode Config.
Mode Config is only triggered if the client request a virtual IP address e.g. with leftsourceip=%config.