T8136: IPSEC PPK Support

[giga1699]

Change Summary

Provides information on use of post-quantum preshared keys (PPK)

Related Task(s)

• https://vyos.dev/T8136

Related PR(s)

vyos/vyos-1x#4930

Backport

Checklist:

• I have read the CONTRIBUTING document

[alexandr-san4ez]

Suggested change

	PPKs can be configued within VyOS under the vpn.ipsec.authentication.ppk
	PPKs can be configued within VyOS under the `vpn ipsec authentication ppk`

In my opinion it will be better this way.

[alexandr-san4ez]

Suggested change

	PPKs can be configued within VyOS under the vpn.ipsec.authentication.ppk
	config.
	.. cfgmod:: edit vpn authentication ppk <name>
	PPKs need an id and a secret value. The ID and secret must match if PPKs are
	required for a successful IPSEC connection. The secret can be plain text, a
	hex value, or a base64 value. The default is plain text. If using another
	type of value, you must define the secret-type.
	.. cfgmod:: set vpn authentication ppk <name> secret-type <plaintext|hex|base64>
	To use a PPK within a site-to-site or remote-access connection, define the PPK
	id under the connection.
	.. cfgmod:: set vpn ipsec site-to-site <name> ppk id <id>
	Optionally, you can require the use of PPK to have a successful connection.
	.. cfgmod:: set vpn ipsec site-to-site <name> ppk required
	To confirm the use of a PPK in an IKE SA, check for the presence of "up-ppk" in
	the output of the show command under the status heading. If you only see "up", or
	"down", PPK is not in use.
	.. cfgmod:: show vpn ike sa
	.. cfgmod:: edit vpn authentication ppk <name>
	PPKs can be configued within VyOS under the `vpn ipsec authentication ppk`
	config.
	.. cfgmod:: set vpn authentication ppk <name> secret-type <plaintext|hex|base64>
	PPKs need an id and a secret value. The ID and secret must match if PPKs are
	required for a successful IPSEC connection. The secret can be plain text, a
	hex value, or a base64 value. The default is plain text. If using another
	type of value, you must define the secret-type.
	.. cfgmod:: set vpn ipsec site-to-site <name> ppk id <id>
	To use a PPK within a site-to-site or remote-access connection, define the PPK
	id under the connection.
	.. cfgmod:: set vpn ipsec site-to-site <name> ppk required
	Optionally, you can require the use of PPK to have a successful connection.
	.. cfgmod:: show vpn ike sa
	To confirm the use of a PPK in an IKE SA, check for the presence of "up-ppk" in
	the output of the show command under the status heading. If you only see "up", or
	"down", PPK is not in use.

As I see on other pages, the command description should be after the command (not before).

[alexandr-san4ez]

The changes I requested have been made.