STRONGSWAN.CONF(5) strongSwan STRONGSWAN.CONF(5) strongswan.conf - strongSwan ipsec.conf(5) IPsec strongSwan . (parse) ipsec starter . strongSwan . 4.2.1 strongSwan strongswan.conf(5) . strongswan.conf / . C . / : settings := (section|keyvalue)* section := name { settings } keyvalue := key = value\n . # . : . , : { } = " # \n \t space : a = b section-one { somevalue = asdf subsection { othervalue = xxx } # yei, a comment yetanother = zz } section-two { x = 12 } () . () ( "0x" ) . (locale) ( ) "C" . () ( "0x" ) . ( ) "." . . "s" "m" "h" "d" ( "14400" "4h" ). ( ). . . swanctl.conf ( ) . : section := name : references { settings } references := absname[, absname]* absname := name[.name]* / . ( ). / . ( round ) / ( ). . : conn-defaults { # default settings for all conns (e.g. a cert, or IP pools) } eap-defaults { # defaults if eap is used (e.g. a remote auth round) } child-defaults { # defaults for child configs (e.g. traffic selectors) } connections { conn-a : conn-defaults, eap-defaults { # set/override stuff specific to this connection children { child-a : child-defaults { # set/override stuff specific to this child } } } conn-b : conn-defaults { # set/override stuff specific to this connection children { child-b : child-defaults { # set/override stuff specific to this child } } } conn-c : connections.conn-a { # everything is inherited, including everything conn-a # already inherits from the sections it and its # sub-section reference } } include strongswan.conf : include /some/path/*.conf include . ( sh(1)) . . . include . : a = b section-one { somevalue = before include include include.conf } include other.conf include.conf: # settings loaded from this file are added to section-one # the following replaces the previous value somevalue = asdf subsection { othervalue = yyy } yetanother = zz other.conf: # this extends section-one and subsection section-one { subsection { # this replaces the previous value othervalue = xxx } } section-two { x = 12 } . section-one.subsection.othervalue xxx . ( ). ( ) . aikgen.load [] ipsec aikgen . attest.database [] (URI) . . attest.load [] ipsec attest . charon IKE charon. : charon-cmd charon . ( charon-cmd charon). libstrongswan . charon.accept_private_algs [no] IKE . charon.accept_unencrypted_mainmode_messages [no] (payloads) ID HASH (Main Mode) IKEv1. Main Mode PSK ID . Aggressive Mode : () HASH (brute force) PSK . no ( SonicWall) . charon.block_threshold [5] IKE_SA ( IKE_SA_INIT ) IP . charon.cache_crls [no] (CRL) HTTP LDAP (CA) ${sysconfdir}/ipsec.d/crls (stroke) ${sysconfdir}/swanctl/x509crl (vici) . charon.cert_cache [yes] () . charon.check_current_path [no] / . DPD . NAT MOBIKE . charon.cisco_flexvpn [no] (Vendor ID) Cisco FlexVPN Cisco (Traffic Selector) ( strongSwan) IP strongSwan . Cisco FlexVPN (initiator) TS 0.0.0.0/0 == 0.0.0.0/0 . Cisco "tunnel mode ipsec ipv4" GRE . charon.cisco_unity [no] Cisco Unity ( IKEv1). charon.close_ike_on_child_failure [no] IKE_SA CHILD_SA IKE_AUTH. charon.cookie_threshold [30] IKE_SA ( IKE_SA_INIT ) . charon.cookie_threshold_ip [3] IKE_SA ( IKE_SA_INIT ) IP . charon.crypto_test.bench [no] () . charon.crypto_test.bench_size [1024] . charon.crypto_test.bench_time [50] . charon.crypto_test.on_add [no] ( test-vectors ). charon.crypto_test.on_create [no] . charon.crypto_test.required [no] . charon.crypto_test.rng_true [no] RNG (TRUE) . charon.delete_rekeyed [no] CHILD_SA ( IKEv1). CHILD_SA . SA . charon.delete_rekeyed_delay [5] IPsec SA ( IKEv2). CHILD_SA . 0 CHILD_SA ( ). charon.dh_exponent_ansi_x9_42 [yes] DH ANSI X9.42 . charon.dlopen_use_rtld_now [no] RTLD_NOW dlopen IMV/IMC . charon.dns1 [] DNS (CP). charon.dns2 [] DNS (CP). charon.dos_protection [yes] (DoS) . charon.filelog LOGGER CONFIGURATION strongswan.conf(5). charon.filelog. . path . charon.filelog.. [] . charon.filelog..append [yes] . charon.filelog..default [1] . charon.filelog..flush_line [no] . charon.filelog..ike_name [no] IKE_SA . charon.filelog..json [no] JSON . "time" ( `time_format` ) "thread" "group" "level" "msg". (escape) . `ike_name` "ikesa-uniqueid" "ikesa-name" . `log_level` . charon.filelog..log_level [no] ( [IKE2]). charon.filelog..path [] . . . charon.filelog..time_format [] . strftime(3) . charon.filelog..time_precision [] (ms) (us) ( time_format %S %T ). . charon.flush_auth_cfg [no] ( ) IKE_SA . . charon.follow_redirects [yes] (redirects) IKEv2 RFC 5685 . charon.force_eap_only_authentication [no] RFC 5998 EAP EAP_ONLY_AUTHENTICATION IKE_AUTH . charon.fragment_size [1280] ( IP ) (fragment) IKE IKEv1 IKEv2 1280 ( 0 IPv4 ). IPv4 IPv6 . charon.fragment_size_v4 [charon.fragment_size] ( IPv4 ) IKE IKEv1 IKEv2. charon.fragment_size_v6 [charon.fragment_size] ( IPv6 ) IKE IKEv1 IKEv2. charon.group [] . charon.half_open_timeout [30] IKE_SA ( IKE_SA_INIT DROPPING). charon.hash_and_url [no] (Hash and URL). charon.host_resolver.max_threads [3] (threads) ( ). charon.host_resolver.min_threads [0] . charon.i_dont_care_about_security_and_use_aggressive_mode_psk [no] (responders) (Aggressive Mode) IKEv1 (PSK) ( PSK ). charon.ignore_acquire_ts [no] acquire ( ) IKEv2 . . IKEv1 CHILD_SA . charon.ignore_routing_tables [] ( ) . charon.ikesa_limit [0] IKE_SA . charon.ikesa_table_segments [1] . charon.ikesa_table_size [1] IKE_SA. charon.imcv libimcv . charon.imcv.assessment_result [yes] IMV Assessment Result IETF . charon.imcv.database [] (URI) IMV. . charon.imcv.os_info.default_password_enabled [no] . charon.imcv.os_info.name [] ( Ubuntu). charon.imcv.os_info.version [] ( 12.04 i686). charon.imcv.policy_script [ipsec _imv_policy] TNC IMV . charon.inactivity_close_ike [no] CHILD_SA IKE_SA . charon.init_limit_half_open [0] IKE_SA IKE_SA_INIT DROPPING strongswan.conf(5). charon.init_limit_job_load [0] ( IKE_SA_INIT DROPPING). charon.initiator_only [no] charon IKE . charon.install_routes [yes] IPsec. charon.install_virtual_ip [yes] IP . charon.install_virtual_ip_on [] IP . . charon.integrity_test [no] libstrongswan . charon.interfaces_ignore [] ( ) interfaces_use . charon.interfaces_use [] ( ) charon . . charon.iptfs IP-TFS ( RFC 9347). 6.14 . / IP ESP/AGGFRAG IP-TFS . charon.iptfs.accept_fragments [yes] AGGFRAG . IKEv2 . charon.iptfs.dont_frag [no] AGGFRAG ( ). charon.iptfs.drop_time [1000000] . charon.iptfs.init_delay [0] . . charon.iptfs.max_queue_size [1048576] ( 1 ). . charon.iptfs.packet_size [0] ( ) . 0 PMTU . (pad) . charon.iptfs.reorder_window [3] . charon.keep_alive [20s] NAT (Keep-alive). charon.keep_alive_dpd_margin [0s] NAT DPD (0 ). ( CLOCK_BOOTTIME). charon.leak_detective.detailed [yes] (leak detective). charon.leak_detective.usage_threshold [10240] (0 ). charon.leak_detective.usage_threshold_count [0] (0 ). charon.load [] IKE charon . charon.load_modular [no] charon.plugins..load . ( 1 ). . . charon.make_before_break [yes] IKEv2 << >> (make-before-break) << >> (break-before- make). SA IKE CHILD_SA . SA . strongSwan 5.3.0 SA . charon.max_ikev1_exchanges [3] IKEv1 IKE_SA . charon.max_packet [10000] charon. charon.multiple_authentication [yes] (RFC 4739). charon.nbns1 [] WINS (CP). charon.nbns2 [] WINS (CP). charon.ocsp_nonce_len [32] (nonces) OCSP. RFC 8954 1 32 32 . 16 . charon.plugins.addrblock.depth [-1] RFC3779 addrblock addrblock (Root CA) . -1 . () addrblock C . addrblock : 0 1 . charon.plugins.addrblock.strict [yes] yes addrblock addrblock . no addrblock . charon.plugins.android_log.loglevel [1] . charon.plugins.attr (CP) . charon.plugins.attr. [] address netmask dns nbns dhcp subnet split-include split-exclude . IPv4/IPv6 CIDR . . charon.plugins.attr-sql.crash_recovery [yes] . VPN . charon.plugins.attr-sql.database [] (URI) attr-sql charon. . charon.plugins.attr-sql.lease_history [yes] () IP SQL. charon.plugins.botan.internal_rng_only [no] RNG Botan . Botan rng_t RNG . charon.plugins.botan.rng.strong [user-threadsafe] RNG Botan RNG_STRONG RNG_WEAK ( user user-threadsafe system). charon.plugins.botan.rng.true [system] RNG Botan RNG_TRUE ( user user-threadsafe system). charon.plugins.bypass-lan.interfaces_ignore [] ( ) interfaces_use . charon.plugins.bypass-lan.interfaces_use [] ( ) . . charon.plugins.certexpire.csv.cron [] cron CSV. charon.plugins.certexpire.csv.empty_string [] CA . charon.plugins.certexpire.csv.fixed_fields [yes] CA . charon.plugins.certexpire.csv.force [yes] . charon.plugins.certexpire.csv.format [%d:%m:%Y] strftime(3) . charon.plugins.certexpire.csv.local [] strftime(3) CSV . charon.plugins.certexpire.csv.remote [] strftime(3) CSV (remote). charon.plugins.certexpire.csv.separator [,] CSV. charon.plugins.coupling.file [] (coupling). charon.plugins.coupling.hash [sha1] . charon.plugins.coupling.max [1] . charon.plugins.curl.redir [-1] 0 -1 . charon.plugins.curl.tls_backend [] SSL/TLS curl ( libcurl 7.56 ). 2 . 1 . charon.plugins.dhcp.force_server_address [no] . DHCP strongSwan DHCP loopback . unicast ( 255.255.255.255) loopback . yes ( 192.168.0.255) . charon.plugins.dhcp.identity_lease [no] MAC IKE DHCP. charon.plugins.dhcp.interface [] . (bind) (0.0.0.0) DHCP . charon.plugins.dhcp.interface_receive [charon.plugins.dhcp.interface] . . . `lo` . charon.plugins.dhcp.server [255.255.255.255] IP (unicast) (broadcast) DHCP. charon.plugins.dhcp.use_server_port [no] DHCP (67) DHCP (68) (relay agent) . DHCP DHCP ICMP DHCP . DHCP (bind) . DHCP ( ICMP ). charon.plugins.dnscert.enable [no] CERT DNS. charon.plugins.drbg.max_drbg_requests [4294967294] DRBG (reseeding) . charon.plugins.eap-aka.request_identity [yes] charon.plugins.eap-aka-3gpp.seq_check [] AKA SQN . charon.plugins.eap-aka-3gpp2.seq_check [] AKA SQN . charon.plugins.eap-dynamic.prefer_user [no] EAP EAP-Nak . charon.plugins.eap-dynamic.preferred [] () EAP . . . charon.plugins.eap-gtc.backend [pam] XAuth . charon.plugins.eap-peap.fragment_size [1024] EAP-PEAP. charon.plugins.eap-peap.include_length [no] EAP-PEAP. charon.plugins.eap-peap.max_message_count [32] EAP-PEAP (0 = ). charon.plugins.eap-peap.phase2_method [mschapv2] EAP. charon.plugins.eap-peap.phase2_piggyback [no] (piggyback) EAP TLS Finished TLS 1.2 . charon.plugins.eap-peap.phase2_tnc [no] TNC EAP . charon.plugins.eap-peap.request_peer_auth [no] . charon.plugins.eap-radius.accounting [no] (accounting) RADIUS. charon.plugins.eap-radius.accounting_close_on_timeout [yes] IKE_SA RADIUS. charon.plugins.eap-radius.accounting_interval [0s] RADIUS RADIUS Access-Accept . charon.plugins.eap-radius.accounting_requires_vip [no] IKE_SA IP . IKEv2 IKEv1 IP . charon.plugins.eap-radius.accounting_send_class [no] Class Access-Accept RADIUS . charon.plugins.eap-radius.class_group [no] class RADIUS-Accept rightgroups ipsec.conf(5) . charon.plugins.eap-radius.close_all_on_timeout [no] IKE_SA RADIUS . IKE_SA . charon.plugins.eap-radius.dae.enable [no] DAE ( RFC 5176). charon.plugins.eap-radius.dae.listen [0.0.0.0] DAE RADIUS. charon.plugins.eap-radius.dae.port [3799] DAE. charon.plugins.eap-radius.dae.secret [] (Shared secret) / DAE. . charon.plugins.eap-radius.eap_start [no] EAP-Start EAP-Identity RADIUS. charon.plugins.eap-radius.filter_id [no] tunnel_type RADIUS ESP filter_id RADIUS-Accept rightgroups ipsec.conf(5) . charon.plugins.eap-radius.forward.ike_to_radius [] RADIUS IKEv2 RADIUS ( Reply-Message 11 36906:12). charon.plugins.eap-radius.forward.radius_to_ike [] charon.plugins.eap-radius.forward.ike_to_radius RADIUS IKEv2 strongSwan (40969) . charon.plugins.eap-radius.id_prefix [] EAP-Identity AAA IMSI EAP . charon.plugins.eap-radius.nas_identifier [strongSwan] NAS ( NAS-Identifier) RADIUS. charon.plugins.eap-radius.port [1812] RADIUS ( ). charon.plugins.eap-radius.retransmit_base [1.4] (exponential backoff). charon.plugins.eap-radius.retransmit_timeout [2.0] . charon.plugins.eap-radius.retransmit_tries [4] . charon.plugins.eap-radius.secret [] RADIUS NAS. . charon.plugins.eap-radius.server [] IP/ RADIUS. charon.plugins.eap-radius.servers RADIUS. source nas_identifier secret sockets port ( auth_port) . IP/ address . acct_port [1813] RADIUS . RADIUS preference [0] . retransmit_base retransmit_timeout retransmit_tries . charon.plugins.eap-radius.sockets [1] () . charon.plugins.eap-radius.source [] IP . charon.plugins.eap-radius.station_id_with_port [yes] UDP Called-Station-Id Calling-Station-Id RADIUS . charon.plugins.eap-radius.xauth XAuth RADIUS. . XAuth . XAuth User-Password RADIUS . XAuth password passcode nextpin answer. strongSwan AAA ( ) . ipsec.conf(5) ( ) xauth-radius rightauth rightauth2 : rightauth2=xauth-radius:profile. charon.plugins.eap-sim.request_identity [yes] charon.plugins.eap-simaka-sql.database [] charon.plugins.eap-simaka-sql.remove_used [no] charon.plugins.eap-tls.fragment_size [1024] EAP-TLS. charon.plugins.eap-tls.include_length [yes] EAP-TLS. charon.plugins.eap-tls.max_message_count [32] EAP-TLS (0 = ). charon.plugins.eap-tnc.max_message_count [10] EAP-TNC (0 = ). charon.plugins.eap-tnc.protocol [tnccs-2.0] IF-TNCCS (tnccs-2.0 ). charon.plugins.eap-ttls.fragment_size [1024] EAP-TTLS. charon.plugins.eap-ttls.include_length [yes] EAP-TTLS. charon.plugins.eap-ttls.max_message_count [32] EAP-TTLS (0 = ). charon.plugins.eap-ttls.phase2_method [md5] EAP. charon.plugins.eap-ttls.phase2_piggyback [no] EAP TLS Finished. charon.plugins.eap-ttls.phase2_tnc [no] TNC EAP . charon.plugins.eap-ttls.phase2_tnc_method [pt] TNC EAP (pt IETF tnc) charon.plugins.eap-ttls.request_peer_auth [no] . charon.plugins.error-notify.socket [unix://${piddir}/charon.enfy] error-notify. charon.plugins.ext-auth.script [] . . IKE_SA . : IKE_UNIQUE_ID: IKE_SA. IKE_NAME: . IKE_LOCAL_HOST: IP IKE. IKE_REMOTE_HOST: IP ( ) IKE. IKE_LOCAL_ID: IKE. IKE_REMOTE_ID: IKE. IKE_REMOTE_EAP_ID: EAP XAuth . charon.plugins.forecast.groups [224.0.0.1,224.0.0.22,224.0.0.251,224.0.0.252,239.255.255.250] (multicast) . (LAN) . . IGMP mDNS LLMNR SSDP/WS-Discovery . charon.plugins.forecast.interface [] . . (LAN) / . charon.plugins.forecast.reinject [] CHILD_SA / . / . . / IPsec. charon.plugins.ha.autobalance [0] . 0 . charon.plugins.ha.buflen [2048] HA . IKEv1 DH DH HA ( modp4096 ). charon.plugins.ha.fifo_interface [yes] charon.plugins.ha.heartbeat_delay [1000] charon.plugins.ha.heartbeat_timeout [2100] charon.plugins.ha.local [] charon.plugins.ha.monitor [yes] charon.plugins.ha.pools [] charon.plugins.ha.receive_buffer_size [8388608] HA . HA . 0 `/proc/sys/net/core/rmem_default` . . `/proc/sys/net/core/rmem_max` (CAP_NET_ADMIN) . charon.plugins.ha.remote [] charon.plugins.ha.resync [yes] charon.plugins.ha.secret [] charon.plugins.ha.segment_count [1] charon.plugins.ipseckey.enable [no] IPSECKEY DNS. charon.plugins.kernel-libipsec.allow_peer_ts [no] IKE . ( TUN) IKE . fwmark kernel-netlink socket-default . charon.plugins.kernel-libipsec.fwmark [charon.plugins.socket-default.fwmark] (Firewall mark) ESP . charon.plugins.kernel-libipsec.raw_esp [no] NAT ESP UDP . charon.plugins.kernel-netlink.buflen [] Netlink . charon.plugins.kernel-netlink.fwmark [] . [!]mark[/mask] ( ). charon.plugins.kernel-netlink.hw_offload_feature_interface [lo] (Hardware offloading) . loopback . loopback . charon.plugins.kernel-netlink.ignore_retransmit_errors [no] . charon.plugins.kernel-netlink.install_routes_xfrmi [no] XFRM SA if_id_out . IKE ( / (bypass) IKE fwmark). charon.plugins.kernel-netlink.mss [0] MSS 0 . charon.plugins.kernel-netlink.mtu [0] MTU 0 . charon.plugins.kernel-netlink.parallel_route [no] Netlink ROUTE . . DUMP EBUSY . charon.plugins.kernel-netlink.parallel_xfrm [no] Netlink XFRM . charon.plugins.kernel-netlink.policy_update [no] XFRM_MSG_UPDPOLICY . charon.plugins.kernel-netlink.port_bypass [no] XFRM IKE . IKE IKE XFRM . UDP IKE XFRM UDP IKE . charon.plugins.kernel-netlink.process_rules [no] (roam) . ( fwmark ). charon.plugins.kernel-netlink.receive_buffer_size [8388608] Netlink . Netlink Netlink . 0 /proc/sys/net/core/rmem_default . . /proc/sys/net/core/rmem_max (CAP_NET_ADMIN) . charon.plugins.kernel-netlink.retries [0] Netlink . charon.plugins.kernel-netlink.roam_events [yes] (roam) . charon.plugins.kernel-netlink.set_proto_port_transport_sa [no] SA IPsec (transport mode) . SA IPsec . charon.plugins.kernel-netlink.spdh_thresh XFRM IPv4 IPv6. . IPsec ( out in forward) ( out in forward) . . 3.18 4.8 . charon.plugins.kernel-netlink.spdh_thresh.ipv4.lbits [32] XFRM IPv4. charon.plugins.kernel-netlink.spdh_thresh.ipv4.rbits [32] XFRM IPv4. charon.plugins.kernel-netlink.spdh_thresh.ipv6.lbits [128] XFRM IPv6. charon.plugins.kernel-netlink.spdh_thresh.ipv6.rbits [128] XFRM IPv6. charon.plugins.kernel-netlink.timeout [0] Netlink 0 . charon.plugins.kernel-netlink.xfrm_acq_expires [165] acquire XFRM trap . /proc/sys/net/core/xfrm_acq_expires . acquire XFRM trap . SPI . IKE IKEv2 RETRANSMISSION strongswan.conf(5). charon.plugins.kernel-pfkey.events_buffer_size [0] (0 ). . charon.plugins.kernel-pfkey.route_via_internal [no] . IP IPsec . IP TUN . charon.plugins.kernel-pfroute.mtu [1400] MTU TUN IP . charon.plugins.kernel-pfroute.vip_wait [1000] / IP . charon.plugins.load-tester load-tester LOAD TESTS strongswan.conf(5) . charon.plugins.load-tester.addrs / ( CIDR) eth0 = 10.10.0.0/16. charon.plugins.load-tester.addrs_keep [no] SA . charon.plugins.load-tester.addrs_prefix [16] . -1 ( 32 128). charon.plugins.load-tester.ca_dir [] CA (). charon.plugins.load-tester.child_rekey [600] CHILD_SA . charon.plugins.load-tester.crl [] URI CRL . charon.plugins.load-tester.delay [0] (thread). charon.plugins.load-tester.delete_after_established [no] IKE_SA . charon.plugins.load-tester.digest [sha1] (digest) . charon.plugins.load-tester.dpd_delay [0] DPD . charon.plugins.load-tester.dynamic_port [0] ( ). charon.plugins.load-tester.eap_password [default-pwd] EAP . charon.plugins.load-tester.enable [no] (load testing). : . . charon.plugins.load-tester.esp [aes128-sha1] (proposal) CHILD_SA . charon.plugins.load-tester.fake_kernel [no] . charon.plugins.load-tester.ike_rekey [0] IKE_SA . charon.plugins.load-tester.init_limit [0] SA . charon.plugins.load-tester.initiator [0.0.0.0] . charon.plugins.load-tester.initiator_auth [pubkey] () . charon.plugins.load-tester.initiator_id [] . charon.plugins.load-tester.initiator_match [] . charon.plugins.load-tester.initiator_tsi [] . charon.plugins.load-tester.initiator_tsr [] . charon.plugins.load-tester.initiators [0] . charon.plugins.load-tester.issuer_cert [] ( ). charon.plugins.load-tester.issuer_key [] ( ). charon.plugins.load-tester.iterations [1] IKE_SA . charon.plugins.load-tester.mode [tunnel] IPsec tunnel transport beet. charon.plugins.load-tester.pool [] INTERNAL_IPV4_ADDR . charon.plugins.load-tester.preshared_key [] . charon.plugins.load-tester.proposal [aes128-sha1-modp768] IKE . charon.plugins.load-tester.request_virtual_ip [no] INTERNAL_IPV4_ADDR INTERNAL_IPV6_ADDR . charon.plugins.load-tester.responder [127.0.0.1] . charon.plugins.load-tester.responder_auth [pubkey] () . charon.plugins.load-tester.responder_id [] . charon.plugins.load-tester.responder_tsi [initiator_tsi] () . charon.plugins.load-tester.responder_tsr [initiator_tsr] . charon.plugins.load-tester.shutdown_when_complete [no] IKE_SA. charon.plugins.load-tester.socket [unix://${piddir}/charon.ldt] load-tester. charon.plugins.load-tester.version [0] IKE ( 0 IKEv2 ). charon.plugins.lookip.socket [unix://${piddir}/charon.lkp] lookip. charon.plugins.openssl.engine_id [pkcs11] (ENGINE ID) OpenSSL. charon.plugins.openssl.fips_mode [0] FIPS OpenSSL. OpenSSL 3.0 (0) (1) Suite B (2). OpenSSL 3 0 fips base (load_legacy ). fipsmodule.cnf ( MAC ) . charon.plugins.openssl.load_legacy [yes] (legacy provider) OpenSSL 3 MD4 DES Blowfish ( EAP-MSCHAPv2 ). OpenSSL ( fips) . charon.plugins.openxpki.database [] (URI) certificate OpenXPKI. . charon.plugins.osx-attr.append [yes] DNS . charon.plugins.p-cscf.enable P-CSCF . charon.plugins.p-cscf.enable. [no] ePDG P-CSCF . IP . charon.plugins.pkcs11.modules PKCS#11 . charon.plugins.pkcs11.modules..load_certs [yes] . charon.plugins.pkcs11.modules..os_locking [no] . charon.plugins.pkcs11.modules..path [] (shared object) PKCS#11. charon.plugins.pkcs11.reload_certs [no] SIGHUP charon. charon.plugins.pkcs11.use_dh [no] PKCS#11 DH ECDH ( use_ecc). charon.plugins.pkcs11.use_ecc [no] PKCS#11 ECDH ECDSA . ECDSA . charon.plugins.pkcs11.use_hasher [no] PKCS#11 . charon.plugins.pkcs11.use_pubkey [no] PKCS#11 . charon.plugins.pkcs11.use_rng [no] PKCS#11 RNG . charon.plugins.pkcs11.use_rsa_pss_hashers [no] PKCS#11 RSA-PSS ( PKCS#11 RSA-PSS ). charon.plugins.radattr.dir [] RADIUS . charon.plugins.radattr.message_id [-1] IKE_AUTH (-1) IKE_AUTH IKEv2 . charon.plugins.random.random [${random_device}] . charon.plugins.random.strong_equals_true [no] yes RNG_STRONG RNG_TRUE . charon.plugins.random.urandom [${urandom_device}] . charon.plugins.resolve.file [/etc/resolv.conf] DNS resolvconf(8). charon.plugins.resolve.resolvconf.iface [lo.ipsec] resolvconf(8). resolvconf . interface-order(5) . charon.plugins.resolve.resolvconf.path [/sbin/resolvconf] / resolvconf(8). "resolvconf" PATH . resolvconf(8) . charon.plugins.resolve.file . charon.plugins.revocation.enable_crl [yes] CRL . charon.plugins.revocation.enable_ocsp [yes] OCSP . charon.plugins.revocation.timeout [10s] OCSP/CRL. charon.plugins.save-keys.esp [no] ESP . charon.plugins.save-keys.ike [no] IKE . charon.plugins.save-keys.load [no] . charon.plugins.save-keys.wireshark_keys [] Wireshark . IKEv1 ikev1_decryption_table . IKEv2 ikev2_decryption_table . ESP CHILD_SA esp_sa . charon.plugins.socket-default.fwmark [] (Firewall mark) . charon.plugins.socket-default.set_source [yes] . charon.plugins.socket-default.set_sourceif [no] . link-local IPv6 . charon.plugins.socket-default.use_ipv4 [yes] IPv4 . charon.plugins.socket-default.use_ipv6 [yes] IPv6 . charon.plugins.sql.database [] (URI) SQL charon. . charon.plugins.sql.loglevel [-1] SQL. charon.plugins.stroke.allow_swap [yes] / left|right . left local () . charon.plugins.stroke.ignore_missing_ca_basic_constraint [no] ipsec.d/cacerts ca ipsec.conf CA CA . charon.plugins.stroke.max_concurrent [4] stroke . charon.plugins.stroke.prevent_loglevel_changes [no] stroke . charon.plugins.stroke.secrets_file [${sysconfdir}/ipsec.secrets] ipsec.secrets. charon.plugins.stroke.socket [unix://${piddir}/charon.ctl] stroke. charon.plugins.stroke.timeout [0] stroke. 0 . charon.plugins.systime-fix.interval [0] . 0 . charon.plugins.systime-fix.reauth [no] (reauth) . charon.plugins.systime-fix.threshold [] . . charon.plugins.systime-fix.threshold_format [%Y] strptime(3) . charon.plugins.systime-fix.timeout [0s] . 0 . charon.plugins.tnc-imc.dlclose [yes] IMC . charon.plugins.tnc-imc.preferred_language [en] TNC. charon.plugins.tnc-imv.dlclose [yes] IMV . charon.plugins.tnc-imv.recommendation_policy [default] TNC default any all. charon.plugins.tnc-pdp.pt_tls.enable [yes] PT-TLS strongSwan PDP. charon.plugins.tnc-pdp.pt_tls.port [271] PT-TLS strongSwan PDP . charon.plugins.tnc-pdp.radius.enable [yes] RADIUS strongSwan PDP. charon.plugins.tnc-pdp.radius.method [ttls] EAP . charon.plugins.tnc-pdp.radius.port [1812] RADIUS strongSwan PDP . charon.plugins.tnc-pdp.radius.secret [] RADIUS strongSwan PDP NAS. . charon.plugins.tnc-pdp.server [] strongSwan PDP AAA . charon.plugins.tnc-pdp.timeout [] . charon.plugins.tnccs-20.max_batch_size [65522] PB-TNC ( PT-EAP = 65529). charon.plugins.tnccs-20.max_message_size [65490] PA-TNC ( PT-EAP = 65497). charon.plugins.tnccs-20.mutual [no] PB-TNC. charon.plugins.tnccs-20.tests.pb_tnc_noskip [no] PB-TNC NOSKIP. charon.plugins.tnccs-20.tests.pb_tnc_version [2] PB-TNC PB-TNC. charon.plugins.tpm.ek_handle [] (handle) RSA ECC ( EK) TPM 2.0 ( 0x81010001). charon.plugins.tpm.fips_186_4 [no] TPM 2.0 FIPS-186-4 RSAPSS . charon.plugins.tpm.tcti.name [device|tabrmd] TPM 2.0 TCTI. : tabrmd device mssim. device TPM 2.0 /dev/tpmrm0 tabrmd d-bus TPM 2.0 . charon.plugins.tpm.tcti.opts [/dev/tpmrm0|] TPM 2.0 TCTI. /dev/tpmrm0 TCTI device . charon.plugins.tpm.use_rng [no] TPM RNG ( ) . ( ek_handle ). charon.plugins.unbound.dlv_anchors [] DLV (DNSSEC Lookaside Validation). trust_anchors . DLV DLV lookaside . charon.plugins.unbound.resolv_conf [/etc/resolv.conf] DNS. charon.plugins.unbound.trust_anchors [${sysconfdir}/ipsec.d/dnssec.keys] DNSSEC ( KSK ). DNS Zone DS DNSKEY . charon.plugins.updown.dns_handler [no] updown DNS IKEv1 Mode Config IKEv2 ( resolve ). charon.plugins.vici.socket [unix://${piddir}/charon.vici] vici . charon.plugins.whitelist.enable [yes] (whitelist). charon.plugins.whitelist.socket [unix://${piddir}/charon.wlst] . charon.plugins.wolfssl.fips_mode [no] wolfSSL FIPS . charon.plugins.xauth-eap.backend [radius] EAP (backend) XAuth . charon.plugins.xauth-pam.pam_service [login] PAM . charon.plugins.xauth-pam.session [no] / PAM IKE_SA . charon.plugins.xauth-pam.trim_email [yes] XAuth . charon.port [500] UDP . 0 . charon.port_nat_t [4500] UDP NAT-T. 0 . charon.port . charon.prefer_best_path [no] charon (SA) . yes SA MOBIKE . SA . MOBIKE . charon.prefer_configured_proposals [yes] IKE/IPsec (responder) ( INVALID_KE_PAYLOAD ). charon.prefer_temporary_addrs [no] IPv6 (RFC 4941) . . MOBIKE IPv6 . . charon.process_route [yes] RTM_NEWROUTE RTM_DELROUTE. charon.processor.priority_threads JOB PRIORITY MANAGEMENT strongswan.conf(5) . charon.rdn_matching [strict] RDN DN . strict () reordered relaxed. strict RDN (*) RDN ( ). reordered RDN DN . relaxed DN RDN (RDN ). reordered relaxed strict . charon.receive_delay [0] RTT . charon.receive_delay_request [yes] . charon.receive_delay_response [yes] . charon.receive_delay_type [0] IKEv2 0 . charon.reject_trusted_end_entity [no] ( ) . charon.replay_window [32] (replay window) AH/ESP . charon.reqid_base [1] reqid CHILD_SA . charon.retransmit_base [1.8] IKEv2 RETRANSMISSION strongswan.conf(5) . charon.retransmit_jitter [0] (jitter) (0 ). charon.retransmit_limit [0] (0 ). charon.retransmit_timeout [4.0] transmision ( ). charon.retransmit_tries [5] . charon.retry_initiate_interval [0s] IKE_SA ( DNS) 0 . charon.reuse_ikesa [yes] CHILD_SA IKE_SA ( IKEv1 ). charon.routing_table [] . charon.routing_table_prio [] . charon.rsa_pss [no] RSA PSS PKCS#1 . charon.rsa_pss_trailerfield [no] trailerField 0x01 algorithmIdentifier RSA-PSS ( CONTEXT3) DEFAULT . charon.send_delay [0] RTT . charon.send_delay_request [yes] . charon.send_delay_response [yes] . charon.send_delay_type [0] IKEv2 0 . charon.send_vendor_id [no] strongSwan (Vendor ID). charon.signature_authentication [yes] RFC 7427 . charon.signature_authentication_constraints [yes] rightauth IKEv2 . charon.spi_label [0x0000000000000000] spi_mask SPI IKE . charon.spi_mask [0x0000000000000000] SPI IKE spi_label ( spi_label ). charon.spi_max [0xcfffffff] SPI SA IPsec. charon.spi_min [0xc0000000] SPI SA IPsec. 0x00000100 (256) SPI 1 255 IANA . charon.start-scripts (name = path) . charon.stop-scripts (name = path) . charon.syslog syslog LOGGER CONFIGURATION strongswan.conf(5) . charon.syslog. syslog LOGGER CONFIGURATION strongswan.conf(5) . charon.syslog.. [] . charon.syslog..default [1] . charon.syslog..ike_name [no] IKE_SA . charon.syslog..log_level [no] ( [IKE2]). charon.syslog..map_level [-1] -1 LOG_INFO syslog . strongSwan (0..4) syslog . 5 (LOG_NOTICE) 0 strongSwan LOG_NOTICE 1 LOG_INFO 2 3 4 LOG_DEBUG . () syslog . charon.syslog.identifier [] openlog(3) syslog . openlog(3) ( ). charon.threads [16] (worker threads) charon. . . ipsec statusall . charon.tls.cipher [] TLS. charon.tls.ke_group [] TLS. charon.tls.key_exchange [] TLS. charon.tls.mac [] MAC TLS. charon.tls.send_certreq_authorities [yes] (CA) CertificateRequest . CA . charon.tls.signature [] TLS. charon.tls.suites [] (cipher suites) TLS. charon.tls.version_max [1.2] TLS . charon.tls.version_min [1.2] TLS . charon.tnc.tnc_config [/etc/tnc_config] TNC IMC/IMV. charon.user [] . charon.x509.enforce_critical [yes] (critical extensions) . charon-cmd `charon-cmd`. `charon` . charon-cmd.load_modular [yes] . charon-nm NetworkManager `charon-nm`. `charon` . . charon-nm.ca_dir [] CA . charon-nm.install_virtual_ip_on [lo] IP . NM IP XFRM . charon-nm.load_modular [yes] . charon-nm.mtu [1400] MTU XFRM NM. charon-nm.plugins.kernel-netlink.fwmark [!210] (mark) . charon-nm.plugins.socket-default.fwmark . charon-nm.plugins.socket-default.fwmark [210] IKE ESP XFRM . charon-nm.port [0] 500. (ephemeral) . 500 . charon-nm.port_nat_t [0] 4500 . . 4500 . charon-nm.retransmit_base [1.4] IKEv2 RETRANSMISSION strongswan.conf(5) . charon-nm SA . charon-nm.retransmit_timeout [2.0] transmision ( ). charon-nm.retransmit_tries [3] . charon-nm.routing_table [210] XFRM . IKE . charon-nm.routing_table_prio [210] . IKE . charon-nm.syslog.daemon.default [1] daemon syslog 1. charon-systemd.journal systemd syslog LOGGER CONFIGURATION strongswan.conf(5) . charon-systemd.journal. [] . charon-systemd.journal.default [1] . imv_policy_manager.command_allow [] allow (). imv_policy_manager.command_block [] . imv_policy_manager.database [] (URI) . . imv_policy_manager.load [sqlite] IMV . libimcv.debug_level [1] libimcv. libimcv.load [random nonce gmp pubkey x509] IMC/IMV libimcv . libimcv.plugins.imc-attestation.aik_blob [] (blob) AIK. libimcv.plugins.imc-attestation.aik_cert [] AIK. libimcv.plugins.imc-attestation.aik_handle [] (handle) AIK. libimcv.plugins.imc-attestation.aik_pubkey [] AIK. libimcv.plugins.imc-attestation.hash_algorithm [sha384] . libimcv.plugins.imc-attestation.mandatory_dh_groups [yes] -. libimcv.plugins.imc-attestation.nonce_len [20] (nonce) DH. libimcv.plugins.imc-attestation.pcr17_after [] PCR17 . libimcv.plugins.imc-attestation.pcr17_before [] PCR17 . libimcv.plugins.imc-attestation.pcr17_meas [] PCR17 TBOOT . libimcv.plugins.imc-attestation.pcr18_after [] PCR18 . libimcv.plugins.imc-attestation.pcr18_before [] PCR18 . libimcv.plugins.imc-attestation.pcr18_meas [] PCR17 TBOOT . libimcv.plugins.imc-attestation.pcr_info [no] pcr_before pcr_after . libimcv.plugins.imc-attestation.pcr_padding [no] SHA256 PCR SHA1 IMA . libimcv.plugins.imc-attestation.use_quote2 [yes] Quote2 AIK Quote. libimcv.plugins.imc-attestation.use_version_info [no] Quote2 . libimcv.plugins.imc-hcd.push_info [yes] (quadruple) . libimcv.plugins.imc-hcd.subtypes [] PWG HCD PA. libimcv.plugins.imc-hcd.subtypes.
[] PWG HCD PA . system control marker finisher interface scanner. libimcv.plugins.imc-hcd.subtypes.
. [] . firmware resident_application user_application. libimcv.plugins.imc-hcd.subtypes.
.. [] . libimcv.plugins.imc-hcd.subtypes.
...name [] / (hardcopy device). libimcv.plugins.imc-hcd.subtypes.
...patches [] / . '\\n' . libimcv.plugins.imc-hcd.subtypes.
...string_version [] / . libimcv.plugins.imc-hcd.subtypes.
...version [] ( ) ( ) ( ) ( ) ( ). libimcv.plugins.imc-hcd.subtypes.
.attributes_natural_language [en] RFC 5646 . libimcv.plugins.imc-hcd.subtypes.system.certification_state [] . libimcv.plugins.imc-hcd.subtypes.system.configuration_state [] . libimcv.plugins.imc-hcd.subtypes.system.machine_type_model [] / . libimcv.plugins.imc-hcd.subtypes.system.pstn_fax_enabled [no] PSTN / . libimcv.plugins.imc-hcd.subtypes.system.time_source [] (NTP) / . libimcv.plugins.imc-hcd.subtypes.system.user_application_enabled [no] / . libimcv.plugins.imc-hcd.subtypes.system.user_application_persistence_enabled [no] / . libimcv.plugins.imc-hcd.subtypes.system.vendor_name [] / . libimcv.plugins.imc-hcd.subtypes.system.vendor_smi_code [] SMI / . libimcv.plugins.imc-os.device_cert [] ( /etc/pts/aikCert.der). libimcv.plugins.imc-os.device_handle [] TPM ( 0x81010004). libimcv.plugins.imc-os.device_id [] ( 1083f03988c9762703b1c1080c2e46f72b99cc31). libimcv.plugins.imc-os.device_pubkey [] ( /etc/pts/aikPub.der). libimcv.plugins.imc-os.push_info [yes] . libimcv.plugins.imc-scanner.push_info [yes] . libimcv.plugins.imc-swima.eid_epoch [0x11223344] (epoch) . libimcv.plugins.imc-swima.subscriptions [no] SW Inventory SW Events. libimcv.plugins.imc-swima.swid_database [] (URI) . . libimcv.plugins.imc-swima.swid_directory [${prefix}/share] SWID . libimcv.plugins.imc-swima.swid_full [no] SWID XML. libimcv.plugins.imc-swima.swid_pretty [no] SWID XML (pretty). libimcv.plugins.imc-test.additional_ids [0] IMC . libimcv.plugins.imc-test.command [none] Test IMV . libimcv.plugins.imc-test.dummy_size [0] Test IMV (0 = ). libimcv.plugins.imc-test.retry [no] (handshake). libimcv.plugins.imc-test.retry_command [] Test IMV . libimcv.plugins.imv-attestation.cadir [] (cacerts) AIK. libimcv.plugins.imv-attestation.dh_group [ecp256] -. libimcv.plugins.imv-attestation.hash_algorithm [sha384] . libimcv.plugins.imv-attestation.mandatory_dh_groups [yes] -. libimcv.plugins.imv-attestation.min_nonce_len [0] DH. libimcv.plugins.imv-os.remediation_uri [] (URI) . libimcv.plugins.imv-scanner.remediation_uri [] (URI) (scanner). libimcv.plugins.imv-swima.rest_api.timeout [120] HTTP POST SWID REST API. libimcv.plugins.imv-swima.rest_api.uri [] HTTP URI SWID REST API. libimcv.plugins.imv-test.rounds [0] IMC-IMV. libimcv.stderr_quiet [no] stderr libimcv. libimcv.swid_gen.command [/usr/local/bin/swid_generator] SWID . libimcv.swid_gen.tag_creator.name [strongSwan Project] tagCreator ( ). libimcv.swid_gen.tag_creator.regid [strongswan.org] regid tagCreator. pki.load [] pki . pki.scep.http_bind [] IP HTTP. pki.scep.http_timeout [30s] HTTP. pki.scep.renewal_via_pkcs_req [no] SCEP ( openxpki) PKCSReq (19) RenewalReq (17) . pool.database [] (URI) IP . . pool.load [] ipsec pool . sec-updater sec-updater. sec-updater.database [] (URI) IMV. . sec-updater.load [] sec-updater . sec-updater.swid_gen.command [/usr/local/bin/swid_generator] SWID . sec-updater.swid_gen.tag_creator.name [strongSwan Project] tagCreator ( ). sec-updater.swid_gen.tag_creator.regid [strongswan.org] regid tagCreator. sec-updater.tmp.deb_file [/tmp/sec-updater.deb] deb . sec-updater.tmp.tag_file [/tmp/sec-updater.tag] SWID . sec-updater.tnc_manage_command [/var/www/tnc/manage.py] strongTNC manage.py SWID. starter.config_file [${sysconfdir}/ipsec.conf] ipsec.conf. starter.load_warning [yes] charon. sw-collector sw-collector. sw-collector.database [] (URI) . . sw-collector.first_file [/var/log/bootstrap.log] . sw-collector.first_time [0000-00-00T00:00:00Z] UTC . sw-collector.history [] history.log apt. sw-collector.load [] sw-collector . sw-collector.rest_api.timeout [120] HTTP POST REST API. sw-collector.rest_api.uri [] HTTP URI REST API . swanctl.load [] swanctl . swanctl.socket [unix://${piddir}/charon.vici] VICI . LOGGER CONFIGURATION strongswan.conf(5) (loggers) IKE charon charondebug ipsec.conf(5) . : strongswan.conf charondebug . : (File loggers) charon.filelog . path . stdout stderr . (Syslog loggers) syslog charon.syslog . : daemon auth. . dmn / / mgr IKE_SA IKE_SA ike IKE_SA chd CHILD_SA job / cfg knl IPsec/ net IKE asn / (ASN.1 X.509 ) enc / / tls libtls esp libipsec lib libstrongswan tnc (Trusted Network Connect) imc (Integrity Measurement Collector) imv (Integrity Measurement Verifier) pts (Platform Trust Service) (Loglevels) -1 0 ( SA up/SA down) 1 2 3 (RAW) 4 charon { filelog { charon { path = /var/log/charon.log time_format = %b %e %T append = no default = 1 } stderr { ike = 2 knl = 3 ike_name = yes } } syslog { # LOG_DAEMON daemon { } # IKE LOG_AUTHPRIV auth { default = -1 ike = 0 } } } JOB PRIORITY MANAGEMENT IKEv2 charon (synchronous) (blocking) . RADIUS EAP-RADIUS CRL/OCSP . (liveness checking) . (thread starvation) . . charon : CRITICAL (dispatcher jobs). HIGH INFORMATIONAL (DPD) . MEDIUM HIGH/LOW IKE_SA_INIT. LOW IKE_AUTH. RADIUS CRL . IKE_SA_INIT MEDIUM . charon IKE_AUTH DH . IKE_SA_INIT IKE_SA_INIT DROPPING . . . n n ( ). . charon.processor.priority_threads.critical [0] CRITICAL charon.processor.priority_threads.high [0] HIGH charon.processor.priority_threads.medium [0] MEDIUM charon.processor.priority_threads.low [0] LOW : charon { processor { priority_threads { high = 1 medium = 4 } } } HIGH . stroke . MEDIUM . (CPU) . CRITICAL . . LOW . ( ). Monitoring ipsec statusall . : worker threads: 2 or 32 idle, 5/1/2/22 working, job queue: 0/0/1/149, scheduled: 198 (worker thread): 2 (idle) . 5 CRITICAL ( ). 1 HIGH . stroke . 2 MEDIUM IKE_SA_INIT CREATE_CHILD_SA. 22 LOW IKE_AUTH EAP-RADIUS . (job queue load) . MEDIUM MEDIUM . IKE_SA_INIT DROPPING (responder) IKE_SA_INIT . . . IKE_SA_INIT (drop ). : charon.init_limit_half_open [0] IKE_SA . IKE_SA SA . charon.init_limit_job_load [0] ( ). (rekeying) . . . . . IKE_SA (charon.half_open_timeout). IKE_SA . . LOAD TESTS IKE charon load-tester . . : . . "CN=srv, OU=load-test, O=strongSwan" . "CN=c1-r1, OU=load-test, O=strongSwan" ( ). PSK FQDN . srv.strongswan.org c1-r1.strongswan.org . EAP NAI 100000000010001@strongswan.org . : initiator_auth = pubkey|psk|eap-md5|eap-aka RSA . CA . CA . /CA . - modpnull . proposal = aes128-sha1-modpnull DH . DH . loopback IKE_SA . IKE_SA IKE_SA . SA IPsec SA . SA IPsec . loopback : charon { # IKE_SA CHILD_SA # reuse_ikesa = no # (DoS) dos_protection = no plugins { load-tester { # enable = yes # # initiators = 4 # iterations = 1000 # delay = 20 # # SA fake_kernel = yes } } } IKE_SA . (delay) . . . . (stress testing) (gateway) : charon { reuse_ikesa = no threads = 32 plugins { load-tester { enable = yes # initiators = 10 iterations = 1000 # : # iterations * delay = 100s delay = 100 # remote = 1.2.3.4 # IKE proposal = aes128-sha1-modp1024 # PSK # RSA initiator_auth = psk responder_auth = psk # IP # request_virtual_ip = yes # CHILD_SA child_rekey = 60 } } } IKEv2 RETRANSMISSION (retransmission timeouts) IKEv2 charon : charon.retransmit_base [1.8] charon.retransmit_timeout [4.0] charon.retransmit_tries [5] charon.retransmit_jitter [0] charon.retransmit_limit [0] : relative timeout = retransmit_timeout * retransmit_base ^ (n-1) n . retransmit_limit ( ) . (jitter) : relative timeout -= random(0, retransmit_jitter * relative timeout) : ------------------------------------------------------------------------------------------- 1 4s 4s 2 7s 11s 3 13s 24s 4 23s 47s 5 42s 89s 76s 165s : ${piddir} /var/run ${prefix} /usr ${sysconfdir} /etc ${random_device} /dev/random ${urandom_device} /dev/urandom /etc/strongswan.conf /etc/strongswan.d/ /etc/strongswan.d/charon/ swanctl.conf(5), swanctl(8), ipsec.conf(5), ipsec.secrets(5), ipsec(8), charon-cmd(8) Tobias Brunner Andreas Steffen Martin Willi strongSwan . 6.1.0 STRONGSWAN.CONF(5)