Chapter 5: OpenVPN OpenVPN Commands 451

Default
The default is subnet.

Usage Guidelines
Use this command to specify the topology to use in a client-server environment.
Use the set form of this command to specify the topology.
Use the delete form of this command to remove the topology configuration.
Use the show form of this command to view the topology configuration.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 452

interfaces openvpn <vtunx> shared‐secret‐key‐

file <filename>
Specifies the file containing a secret key shared with the remote end of the tunnel.

Syntax
set interfaces openvpn vtunx shared-secret-key-file filename
delete interfaces openvpn vtunx shared-secret-key-file show
interfaces openvpn vtunx shared-secret-key-file

Command Mode
Configuration mode.

Configuration Statement
interfaces {
openvpn vtunx {
shared‐secret‐key‐file filename
}
}

Parameters

vtunx The identifier for the OpenVPN interface. This may be vtun0 to
vtunx, where x is a non-negative integer.
filename The the shared secret file. The file can be generated using the
generate vpn openvpn-key operational command, and the other
endpoint must have the same file for the pre-shared secret
mechanism to work.

Default
None.

Usage Guidelines
Use this command to specify the file containing a secret key shared with the remote end
of the tunnel.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 453

Certificate and key files are assumed to be in /config/auth unless an absolute path is
specified.
Use the set form of this command to specify the file containing a secret key shared with
the remote end of the tunnel.
Use the delete form of this command to remove the shared secret key file
configuration.
Use the show form of this command to view the shared secret key file configuration.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 454

interfaces openvpn <vtunx> tls

Defines a Transport Layer Security (TLS) configuration.

Syntax
set interfaces openvpn vtunx tls
delete interfaces openvpn vtunx tls
show interfaces openvpn vtunx tls

Command Mode
Configuration mode.

Configuration Statement
interfaces {
openvpn vtunx {
tls {
}
}
}

Parameters

vtunx The identifier for the OpenVPN interface. This may be vtun0 to
vtunx, where x is a non-negative integer.

Default
None.

Usage Guidelines
Use this command to define a Transport Layer Security (TLS) configuration.
Use the set form of this command to create the TLS configuration node.
Use the delete form of this command to remove the TLS configuration node.
Use the show form of this command to view the TLS configuration.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 455

interfaces openvpn <vtunx> tls ca‐cert‐file <filename>

Specifies the file containing the certificate authority’s certificate.

Syntax
set interfaces openvpn vtunx tls ca-cert-file filename
delete interfaces openvpn vtunx tls ca-cert-file
show interfaces openvpn vtunx tls ca-cert-file

Command Mode
Configuration mode.

Configuration Statement
interfaces {
openvpn vtunx {
tls {
ca‐cert‐file filename
}
}
}

Parameters

vtunx The identifier for the OpenVPN interface. This may be vtun0 to
vtunx, where x is a non-negative integer.
filename The file containing the certificate authority's certificate, which will
be used to validate the other endpoint's certificate.

Default
None.

Usage Guidelines
Use this command to specify the file containing the certificate authority’s certificate.
Certificate and key files are assumed to be in /config/auth unless an absolute path is
specified.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 456

Use the set form of this command to specify the file containing the certificate
authority’s certificate.
Use the delete form of this command to remove the pointer to the file containing the
certificate authority’s certificate.
Use the show form of this command to view the configuration.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 457

interfaces openvpn <vtunx> tls cert‐file <filename>

Specifies the file containing the endpoint’s own certificate.

Syntax
set interfaces openvpn vtunx tls cert-file filename
delete interfaces openvpn vtunx tls cert-file
show interfaces openvpn vtunx tls cert-file

Command Mode
Configuration mode.

Configuration Statement
interfaces {
openvpn vtunx {
tls {
cert‐file filename
}
}
}

Parameters

vtunx The identifier for the OpenVPN interface. This may be vtun0 to
vtunx, where x is a non-negative integer.
filename The file containing the endpoint's own certificate, which will be
presented to the other endpoint during the TLS negotiation.

Default
None.

Usage Guidelines
Use this command to specify the file containing the endpoint’s own certificate.
Certificate and key files are assumed to be in /config/auth unless an absolute path is
specified.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 458

Use the set form of this command to specify the file containing the endpoint’s
certificate.
Use the delete form of this command to remove the pointer to the file containing the
endpoint’s certificate.
Use the show form of this command to view the configuration.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 459

interfaces openvpn <vtunx> tls crl‐file <filename>

Specifies the file containing a certificate revocation list.

Syntax
set interfaces openvpn vtunx tls crl-file filename
delete interfaces openvpn vtunx tls crl-file
show interfaces openvpn vtunx tls crl-file

Command Mode
Configuration mode.

Configuration Statement
interfaces {
openvpn vtunx {
tls {
crl‐file filename
}
}
}

Parameters

vtunx The identifier for the OpenVPN interface. This may be vtun0 to
vtunx, where x is a non-negative integer.
filename A file containing a list of certificates that have been revoked, which
will prevent endpoints with these certificates from establishing a
VPN tunnel. Specifying this file in the TLS configuration is
optional.

Default
None.

Usage Guidelines
Use this command to specify the file containing a certificate revocation list.
The file is assumed to be located in /config/auth unless an absolute path is specified.

VPN 6.5R1 v01 Vyatta

Chapter 5: OpenVPN OpenVPN Commands 460

Use the set form of this command to specify the file containing a certificate
revocation list.
Use the delete form of this command to remove the pointer to the file containing a
certificate revocation list.
Use the show form of this command to view the configuration.
VPN 6.5R1 v01
Vyatta