# Generated by Ansible.
# This contains the Opportunistic IPSEC configuration from this node's
# in the {{ network }} to every other node. This also uses a private
# policy, which will hold packages and drop them if negotiation fails.
conn overcloud-private-{{ network }}-ip
        type=tunnel
        authby=null
        leftid=%null
        rightid=%null
        left={{ current_ip }}
        right=%opportunisticgroup
        rightmodecfgclient=yes
        negotiationshunt=hold
        failureshunt=drop
        ikev2=insist
        auto=start
        keyingtries=1
        retransmit-timeout=2s
        # To support being behind NAT
        leftmodecfgclient=yes
        leftcat=yes
        narrowing=yes
