I'm trying to understand the difference between the two setups in relation to IPSec. It is ambiguous to me because IKE daemons are running on both peers irrespective of whether one peer is a "roadwarrior" or not. "Roadwarrior" just means "client", right? So if we speak in terms of IPSec Server and IPSec Client, the practical difference between the two is:
- whether the
mode-config hasresponder=yes or not
- and whether the peer parameter
passive=yes is set
- and whether the peer parameter
send_initial_contact=yes or not
Is that basically the distinction? Or can you do "more" with Site-to-Site that you can't do with roadwarrior?
The distinction is more in the eye of the beholder than an actual technical delineation.
A road warrior connection is assumed to:
- connect a single device/person to a larger network
- be initiated from anywhere (home, hotel, etc.)
- be on-demand, so disconnected for long periods
Site-to-site:
- usually connects entire networks
- usually between fixed places (that can be prepared for this, e.g. by requesting static IP addresses)
- be constantly up
This fits right in with what you write as typical:
- mode-config is used to push configuration - site-to-site tunnels are usually manually configured, so there is no real need to push
- passive=yes - because of the dynamic endpoint (possible nat) and the on-demand nature of the connection, it's usually pointless for the server side to try to reach out and attempt a connection
- send_initiaial_contact - the same as passive
Thanks for your notes! But as with many things in tech, this irks me v much because can't neatly categorise the concept!
So passive=yes & mode-config to push configuration, when client is not a router then. But for routers, neither to be passive and not pushing mode-config. Got it.
passive=yes - because of the dynamic endpoint (possible nat) and the on-demand nature of the connection, it's usually pointless for the server side to try to reach out and attempt a connection
In a site-to-site, if both client and server havepassive=noand responder=nodoes this mean two tunnels are created?
I sort of get what you're saying. But this categorization actually tries to make things simpler, as ironic as it is 
The usual line of thinking is that the two scenarios discussed are - as the site-to-site case - a sort of branch office (of a bank, retailer, etc.) that want a persistent connection to the mothership. The road warrior is an individual (traditionally, a sales agent, now mostly pictured as a work-from-home employee) who wants to join the corporate network.
There are all sorts of situations which have some characteristics of both. As an example, a local company where I happen to be situated, solves their covid work-from-home networking challenges by giving each of their employees a preconfigured Mikrotik that would establish a vpn to the company network and simply broadcast an internal SSID.
If both sides are configured as non-passive, that just means that both will attempt to initiate the connection (if one is not present), and either one may succeed. There are never two connections.
What may be a bit confusing is that for any one connection, two SAs will exist, one for each direction, but this is so for any combination of passive or send_initial configuration (of course given that a tunnel is successfully established.)