ipsec: T7594: Change connection-type to trap for all peers and configurations

The previous 'connection-type respond' option in IPsec site-to-site peers
was misleading - instead of passively waiting for peer initiation, it would
initiate negotiation when matching traffic appeared, potentially causing
SA duplication and renegotiation loops.

Author: alexandr-san4ez

docs/configexamples/azure-vpn-bgp.rst

@@ -105,7 +105,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer 203.0.113.2 authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer 203.0.113.2 authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'respond'
+  set vpn ipsec site-to-site peer 203.0.113.2 connection-type 'initiate'
   set vpn ipsec site-to-site peer 203.0.113.2 description 'AZURE PRIMARY TUNNEL'
   set vpn ipsec site-to-site peer 203.0.113.2 ike-group 'AZURE'
   set vpn ipsec site-to-site peer 203.0.113.2 ikev2-reauth 'inherit'

docs/configexamples/azure-vpn-dual-bgp.rst

@@ -110,7 +110,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure-primary authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer azure-primary authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer azure-primary authentication remote-id '203.0.113.2'
-  set vpn ipsec site-to-site peer azure-primary connection-type 'respond'
+  set vpn ipsec site-to-site peer azure-primary connection-type 'initiate'
   set vpn ipsec site-to-site peer azure-primary description 'AZURE PRIMARY TUNNEL'
   set vpn ipsec site-to-site peer azure-primary ike-group 'AZURE'
   set vpn ipsec site-to-site peer azure-primary ikev2-reauth 'inherit'
@@ -122,7 +122,7 @@ Vyos configuration
   set vpn ipsec site-to-site peer azure-secondary authentication local-id '198.51.100.3'
   set vpn ipsec site-to-site peer azure-secondary authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer azure-secondary authentication remote-id '203.0.113.3'
-  set vpn ipsec site-to-site peer azure-secondary connection-type 'respond'
+  set vpn ipsec site-to-site peer azure-secondary connection-type 'initiate'
   set vpn ipsec site-to-site peer azure-secondary description 'AZURE secondary TUNNEL'
   set vpn ipsec site-to-site peer azure-secondary ike-group 'AZURE'
   set vpn ipsec site-to-site peer azure-secondary ikev2-reauth 'inherit'

docs/configexamples/policy-based-ipsec-and-firewall.rst

@@ -106,7 +106,7 @@ IPSec configuration:
     set vpn ipsec ike-group IKE-GROUP proposal 1 hash 'sha256'
     set vpn ipsec interface 'eth0'
     set vpn ipsec site-to-site peer LEFT authentication mode 'pre-shared-secret'
-    set vpn ipsec site-to-site peer LEFT connection-type 'respond'
+    set vpn ipsec site-to-site peer LEFT connection-type 'none'
     set vpn ipsec site-to-site peer LEFT default-esp-group 'ESP-GROUP'
     set vpn ipsec site-to-site peer LEFT ike-group 'IKE-GROUP'
     set vpn ipsec site-to-site peer LEFT local-address '192.0.2.130'

docs/configuration/vpn/ipsec/site2site_ipsec.rst

@@ -285,14 +285,26 @@ Global Peer Configuration Commands
     after configuring and after boot. In this mode the connection will
     not be restarted in case of disconnection, therefore should be used
     only together with DPD or another session tracking methods.
-  * **respond** - does not try to initiate a connection to a remote
+
+  * **trap** - does not try to initiate a connection to a remote
     peer. In this mode, the IPsec session will be established only
     after initiation from a remote peer. Could be useful when there
     is no direct connectivity to the peer due to firewall or NAT in
     the middle of the local and remote side.
+
+    .. warning:: Using this mode requires careful coordination with parameters
+       such as ``close-action`` and ``dpd-action`` to prevent unintended
+       tunnel uptime behavior. In most environments, this mode is not needed
+       and can lead to connection confusion if used incorrectly.
+
   * **none** - loads the connection only, which then can be manually
     initiated or used as a responder configuration.
 
+  .. note:: For most site-to-site VPNs, configure one peer
+     with ``connection-type initiate`` (active side) and the other peer
+     with ``connection-type none`` (passive side) to
+     ensure stable and predictable tunnel behavior.
+
 .. cfgcmd:: set vpn ipsec site-to-site peer <name> default-esp-group <name>
 
   Name of ESP group to use by default for traffic encryption.
@@ -566,7 +578,7 @@ Policy-Based VPN Example
   set vpn ipsec site-to-site peer PEER1 authentication local-id '10.0.2.2'
   set vpn ipsec site-to-site peer PEER1 authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer PEER1 authentication remote-id '10.0.1.2'
-  set vpn ipsec site-to-site peer PEER1 connection-type 'respond'
+  set vpn ipsec site-to-site peer PEER1 connection-type 'none'
   set vpn ipsec site-to-site peer PEER1 default-esp-group 'ESP-GRPOUP'
   set vpn ipsec site-to-site peer PEER1 ike-group 'IKE-GROUP'
   set vpn ipsec site-to-site peer PEER1 local-address '10.0.2.2'
@@ -696,7 +708,7 @@ Route-Based VPN Example
   set vpn ipsec site-to-site peer PEER1 authentication local-id '10.0.2.2'
   set vpn ipsec site-to-site peer PEER1 authentication mode 'pre-shared-secret'
   set vpn ipsec site-to-site peer PEER1 authentication remote-id '10.0.1.2'
-  set vpn ipsec site-to-site peer PEER1 connection-type 'respond'
+  set vpn ipsec site-to-site peer PEER1 connection-type 'none'
   set vpn ipsec site-to-site peer PEER1 default-esp-group 'ESP-GRPOUP'
   set vpn ipsec site-to-site peer PEER1 ike-group 'IKE-GROUP'
   set vpn ipsec site-to-site peer PEER1 local-address '10.0.2.2'

docs/configuration/vpn/rsa-keys.rst

@@ -77,7 +77,7 @@ On the LEFT (static address):
   set vpn ipsec site-to-site peer @RIGHT default-esp-group MyESPGroup
   set vpn ipsec site-to-site peer @RIGHT ike-group MyIKEGroup
   set vpn ipsec site-to-site peer @RIGHT local-address 192.0.2.10
-  set vpn ipsec site-to-site peer @RIGHT connection-type respond
+  set vpn ipsec site-to-site peer @RIGHT connection-type none
   set vpn ipsec site-to-site peer @RIGHT tunnel 1 local prefix 192.168.99.1/32  # Additional loopback address on the local
   set vpn ipsec site-to-site peer @RIGHT tunnel 1 remote prefix 192.168.99.2/32 # Additional loopback address on the remote