SWANCTL.CONF(5) strongSwan SWANCTL.CONF(5) swanctl.conf - swanctl swanctl.conf swanctl(8) IKE strongSwan . / strongswan.conf(5) . . connections IKE . connections IKE . . connections. IKE . connections..version [2] IKE . 1 IKEv1 ( ISAKMP) 2 IKEv2 () . 0 (responder) IKEv1 IKEv2 IKEv2 . connections..local_addrs [%any] () IKE . IPv4/IPv6 DNS CIDR IP . (initiator) / . . FQDN (resolve) . DNS . connections..remote_addrs [%any] () IKE . IPv4/IPv6 DNS CIDR IP . / . . FQDN . DNS . DNS . connections..local_port [500] UDP IKE. backend 500 . 500 IKE 4500 NAT . IKE backend (socket-dynamic). connections..remote_port [500] UDP IKE. 500 IKE 4500 NAT . connections..proposals [default] (proposal) . -AEAD IKE . AEAD . IKEv2 (RFC 9370) . keX_ ( X 1 7 ) . IKEv2 . IKEv1 . IKEv1 . (-) . . default . connections..vips [] IP IKEv2 Mode Config IKEv1. (wildcard) 0.0.0.0 :: . . connections..aggressive [no] (Aggressive Mode) (Main Mode with Identity Protection) . ID HASH . (PSK) . connections..pull [yes] yes Mode Config (pull mode) IP . no (push mode) IP . IKEv1 IKEv2 . . connections..dscp [000000] (DSCP) IKE . RFC 2474 . connections..encap [no] UDP ESP IKE NAT . NAT ESP UDP . . connections..mobike [yes] MOBIKE IKEv2 . MOBIKE IKEv2 (multi-homing) IPsec . MOBIKE . MOBIKE IKEv2 4500 . . connections..dpd_delay [0s] INFORMATIONAL IKEv2 R_U_THERE IKEv1. DPD IKE ESP/AH DPD . connections..dpd_timeout [0s] charon transmissions . IKEv1 IKEv2 . connections..fragmentation [yes] (fragmentation) IKE ( IKEv1 RFC 7383 IKEv2). yes () accept force no. yes IKE . accept . force ( IKEv1 ) IKE . no . IKE ( no). connections..childless [allow] IKE_SA (childless) RFC 6023 IKEv2 CHILD_SA CREATE_CHILD_SA ( CHILD_SA). allow () prefer force never. allow IKE_SA ( IKE_SA_INIT ) IKE_SA CHILD_SA IKE_AUTH IKE_SA ( ). prefer allow IKE_SA . force . never IKE_SA . connections..send_certreq [yes] (certificate request) CA . / . CA IKE . connections..send_cert [ifasked] . ifasked . never always . connections..ocsp [reply] OCSP / OCSP . reply OCSP OCSP . never OCSP request OCSP both reply request . connections..ppk_id [] (PPK) . connections..ppk_required [no] (PPK) . connections..keyingtries [1] . 1 . 0 . connections..unique [no] . . never INITIAL_CONTACT no INITIAL_CONTACT . keep replace . IKE . EAP XAuth EAP-Identity XAuth . IKE_AUTH ( ) INITIAL_CONTACT . never . connections..reauth_time [0s] IKE. IKE IKE/ISAKMP SA . ( EAP ) . IKEv2 . . make-before-break ( ). break-before-make ( ) . connections..rekey_time [4h] (rekeying) IKE - . IKEv2 IKEv1 . IKE rand_time. reauth_time rekey_time . connections..over_time [10% of rekey_time/reauth_time] IKE_SA / . IKE/ISAKMP . IKE_SA IKE_SA . CHILD_SA over_time rekey_time reauth_time . rekey_time reauth_time . connections..rand_time [over_time] / . / . over_time . connections..pools [] IP IP . pools . connections..if_id_in [0] XFRM /SA . %unique IKE_SA CHILD_SA ( ) %unique-dir (/) . connections..if_id_out [0] XFRM /SA . %unique IKE_SA CHILD_SA ( ) %unique-dir (/) . connections..mediation [no] (mediation) IKEv2 . CHILD_SA . connections..mediated_by [] . . mediation . connections..mediation_peer [] IKE . . mediated_by . IKE . connections..local . . RFC 4739 IKEv2 XAuth IKEv1 . local . . connections..local.round [0] . VICI . connections..local.certs [] . swanctl x509 . . (CA) . connections..local.cert [] . certs . connections..local.cert.file [] . . handle . connections..local.cert.handle [] CKA_ID . file . connections..local.cert.slot [] . connections..local.cert.module [] PKCS#11. connections..local.pubkeys [] . swanctl pubkey . . connections..local.auth [pubkey] . pubkey . psk . xauth IKEv1 XAuth Hybrid eap IKEv2 EAP . xauth backend . backend xauth XAuth . XAuth xauth pubkey ( psk) . xauth Hybrid . eap EAP . EAP EAP . RFC 7427 (" IKEv2") IKEv2 . ike: ( auth remote ). ike:pubkey-sha384-sha256 SHA-384 SHA-256 . . ike: ( ike:) IKEv2 strongswan.conf(5) . RSASSA-PSS rsa/pss pubkey rsa ike:rsa/pss-sha256. pubkey rsa RSASSA-PSS strongswan.conf(5) . connections..local.id [] IKE . IKE subject subjectAltName . IP (FQDN) (DN) . (:) . (#) . . ipv4:10.0.0.1 ID_IPV4_ADDR IKE 0x0a000001 . ipv4:#0a000001 . ASN1 . : ipv4 ipv6 rfc822 email userfqdn fqdn dns asn1dn asn1gn keyid. . connections..local.eap_id [id] EAP-Identity EAP-Identity EAP. connections..local.aaa_id [remote-id] EAP-Identity EAP . EAP EAP-TLS . IKE EAP IKE backend AAA . EAP-(T)TLS TLS . connections..local.xauth_id [id] XAuth XAuth . connections..remote . . RFC 4739 IKEv2 XAuth IKEv1 . remote . . connections..remote.round [0] . VICI . connections..remote.id [%any] IKE . id local . (wildcard) ( *@strongswan.org *.strongswan.org C=CH,O=strongSwan,CN=*). . charon.rdn_matching strongswan.conf(5) RDN . POSIX . ('^') ('$') . (escape ). rfc822 email userfqdn fqdn dns asn1dn. . . : email:^(moon|sun)@strongswan\.org$ fqdn:^vpn[0-9]+\.strongswan\.org$ "asn1dn:^.*CN=.+\\.strongswan\\.org$". connections..remote.eap_id [id] EAP-Identity EAP. "" . id . connections..remote.groups [] . . (Attribute Certificates) backend AAA . connections..remote.cert_policy [] OID . OID . connections..remote.certs [] . swanctl x509 . connections..remote.cert [] . certs . connections..remote.cert.file [] . . handle . connections..remote.cert.handle [] CKA_ID /. file . connections..remote.cert.slot [] . connections..remote.cert.module [] PKCS#11. connections..remote.cacerts [] CA . swanctl x509ca . connections..remote.cacert [] CA . cacerts . connections..remote.cacert.file [] . . handle . connections..remote.cacert.handle [] CKA_ID CA . file . connections..remote.cacert.slot [] CA . connections..remote.cacert.module [] PKCS#11. connections..remote.ca_id [] (CA) subject subjectAltName . cacerts CA CA IKE . connections..remote.pubkeys [] . swanctl pubkey . connections..remote.revocation [relaxed] CRL OCSP. strict . ifuri URI CRL/OCSP . relaxed . connections..remote.auth [pubkey] . auth local . ( ecdsa-384 rsa-2048-ecdsa-256). pubkey ( pubkey-sha256-sha512 rsa-2048-sha256-sha384-sha512 rsa-2048-sha256-ecdsa-256-sha256-sha384). strongswan.conf(5) IKEv2 ( auth local ) IKEv2 . RSASSA-PSS rsa/pss pubkey rsa rsa/pss-sha256. pubkey rsa RSASSA-PSS strongswan.conf(5) . EAP-(T)TLS EAP / ( eap-tls:ecdsa-384-sha384). connections..children. CHILD_SA. children . CHILD_SA . connections..children..ah_proposals [] AH CHILD_SA. . AH . KE CHILD_SA/Quick Mode ( esp_proposals ). IKEv2 (RFC 9370) . keX_ ( X 1 7 ) . IKEv2 . IKEv1 . IKEv1 . . . default . AH ESP . connections..children..esp_proposals [default] ESP CHILD_SA. . ESP -AEAD . AEAD / . CHILD_SA/Quick Mode . IKEv2 CHILD_SA IKE_SA IKE_SA . CHILD_SA CREATE_CHILD_SA . SA . none . IKEv2 (RFC 9370) . keX_ ( X 1 7 ) . keX_none . (Extended Sequence Number) esn noesn . noesn . IKEv2 . IKEv1 . IKEv1 . . . default . AH ESP default ESP . connections..children..sha256_96 [no] IPsec HMAC-SHA-256 (truncation) . . ( ). connections..children..local_ts [dynamic] (traffic selectors) CHILD_SA. CIDR / . dynamic IP . . / ([]) . getservent(3) . (/) . getservent(3) opaque OPAQUE RFC 4301 . backend . icmp ipv6-icmp ICMP . IKEv1 Cisco Unity . IKEv1 CHILD_SA . IKEv1 (CHILD_SA) . IKE (narrowing) IKEv1 IKEv2 . . . connections..children..remote_ts [dynamic] CHILD_SA. local_ts . connections..children..rekey_time [1h or life_time - 10%] CHILD_SA. CHILD_SA - . rand_time . life_time rekey_time CHILD_SA rand_time . connections..children..life_time [rekey_time + 10%] CHILD_SA. CHILD_SA . CHILD_SA . rekey_time . connections..children..rand_time [life_time - rekey_time] rekey_time. life_time rekey_time . connections..children..rekey_bytes [0 or life_bytes - 10%] CHILD_SA. CHILD_SA - . rand_bytes . CHILD_SA . life_bytes rekey_bytes . connections..children..life_bytes [rekey_bytes + 10%] CHILD_SA. CHILD_SA . CHILD_SA . rekey_bytes . connections..children..rand_bytes [life_bytes - rekey_bytes] rekey_bytes. life_bytes rekey_bytes . connections..children..rekey_packets [0 or life_packets - 10%] CHILD_SA. CHILD_SA - . rand_packets . CHILD_SA . life_packets rekey_packets . connections..children..life_packets [rekey_packets + 10%] CHILD_SA. CHILD_SA . CHILD_SA . rekey_bytes . connections..children..rand_packets [life_packets - rekey_packets] rekey_packets. life_packets rekey_packets . connections..children..updown [] updown (up) (down) CHILD_SA. connections..children..hostaccess [no] hostaccess updown. connections..children..mode [tunnel] IPsec CHILD_SA. tunnel CHILD_SA (Tunnel Mode) transport (Transport Mode) . transport_proxy Mobile IPv6 . iptfs IP-TFS . beet Bound End to End Tunnel . transport iptfs beet tunnel . pass drop (shunt policies) IPsec (drop ). connections..children..policies [yes] IPsec. MIPv6 IKE . connections..children..policies_fwd_out [no] IPsec (outbound FWD). drop CHILD_SA . connections..children..dpd_action [clear] DPD CHILD_SA . clear CHILD_SA . trap (trap policy) ( start_action trap ). restart CHILD_SA IKE_SA . connections..children..ipcomp [no] IPComp . IKE IPComp ESP . connections..children..inactivity [0s] CHILD_SA . CHILD_SA . 0 . connections..children..reqid [0] reqid CHILD_SA. CHILD_SA . 0 reqid . connections..children..priority [0] IPsec. drop . 0 . connections..children..interface [] IPsec. connections..children..mark_in [0/0x00000000] Netfilter . Netfilter SA/ . Netfilter SA/ . *mark_in_sa* . %unique CHILD_SA %unique-dir CHILD_SA (/) . (/) . 0xffffffff . connections..children..mark_in_sa [no] *mark_in* SA . . SPI SA ( ) . SA . connections..children..mark_out [0/0x00000000] Netfilter . Netfilter /SA . Netfilter /SA . %unique CHILD_SA %unique-dir CHILD_SA (/) . (/) . 0xffffffff . connections..children..set_mark_in [0/0x00000000] Netfilter IPsec SA . Netfilter ( ) . (/) . 0xffffffff . %same ( ) mark_in %unique %unique-dir . XFRM 4.19 . connections..children..set_mark_out [0/0x00000000] Netfilter IPsec SA . ESP ( ). (/) . 0xffffffff . %same ( ) mark_out %unique %unique-dir . XFRM 4.14 . 4.19 . connections..children..if_id_in [0] XFRM /SA . /SA . %unique CHILD_SA %unique-dir CHILD_SA (/) . connections..children..if_id_out [0] XFRM /SA . /SA . %unique CHILD_SA %unique-dir CHILD_SA (/) . CHILD_SA . connections..children..label [] ( SELinux) IKEv2. label_mode . connections..children..label_mode [system] . system strongSwan SELinux SELinux selinux simple . simple / IKEv2 CHILD_SA . selinux SELinux ( system_u:object_r:ipsec_spd_t:s0) association:polmatch SA (acquire) . trap start_action . acquire IKE_SA . association:polmatch . connections..children..tfc_padding [0] ESP (pad) ESP (TFC) . ESP . 0 TFC mtu TFC (MTU) . connections..children..replay_window [32] IPsec CHILD_SA. backend Netlink 0 IPsec . connections..children..per_cpu_sas [no] CHILD_SA (per-CPU). trap start_action . encap UDP ( NAT encap ) SA ( 4500 ). RSS SPI . . SA UDP 0 . connections..children..hw_offload [no] (hardware offload) CHILD_SA IPsec. crypto packet . packet . auto . connections..children..copy_df [yes] DF (Don't Fragment) IPv4 . MTU (PMTUD) . . connections..children..copy_ecn [yes] (ECN) / IP . . connections..children..copy_dscp [out] DSCP / IP . out in yes no . yes in out . . connections..children..icmp [no] ICMP Destination Unreachable Time Exceeded Fragmentation Needed IP IPsec . (forward) . ICMP IP IP . connections..children..start_action [none] . none . trap (trap policy) . start . trap|start . (unload) CHILD_SA start_action none . start trap ( trap|start ). connections..children..close_action [none] CHILD_SA . none trap CHILD_SA ( start_action trap ). start CHILD_SA . close_action CHILD_SA . . CHILD_SA . secrets (secrets) IKE/EAP/XAuth . secrets . . matched ( ) . secrets.eap EAP . EAP eap . EAP XAuth . secrets.eap.secret [] EAP/XAuth. ASCII 0x Base64 0s . secrets.eap.id [] EAP/XAuth . id . secrets.xauth XAuth . xauth eap EAP XAuth . secrets.ntlm NTLM . NTLM ntlm . NTLM EAP-MSCHAPv2 . secrets.ntlm.secret [] NTLM NT MD4(UTF-16LE(secret)). 0x Base64 0s . secrets.ntlm.id [] NTLM . id . secrets.ike IKE . PSK IKE ike . secrets.ike.secret [] IKE. ASCII 0x Base64 0s . secrets.ike.id [] IKE IKE . id . secrets.ppk (PPK) . PPK ppk . secrets.ppk.secret [] PPK. ASCII 0x Base64 0s . . secrets.ppk.id [] PPK PPK . id . secrets.private private. secrets.private.file [] private . secrets.private.secret [] . secrets.rsa rsa. secrets.rsa.file [] rsa . secrets.rsa.secret [] RSA. secrets.ecdsa ecdsa. secrets.ecdsa.file [] ecdsa . secrets.ecdsa.secret [] ECDSA. secrets.pkcs8 pkcs8. secrets.pkcs8.file [] pkcs8 . secrets.pkcs8.secret [] PKCS#8. secrets.pkcs12 PKCS#12 pkcs12. secrets.pkcs12.file [] pkcs12 . secrets.pkcs12.secret [] PKCS#12. secrets.token / . secrets.token.handle [] CKA_ID . secrets.token.slot [] . secrets.token.module [] PKCS#11 . secrets.token.pin [] PIN . --load-creds . pools . pools IP . pools. . pools..addrs [] . CIDR (<>-<>) . CIDR (network ID) ( 10.1.0.5/24 10.1.0.0/24) ( VPN ). . pools.. [] . dns nbns dhcp netmask server subnet p_cscf split_include split_exclude CIDR . . authorities (CA) . authorities. . authorities..cacert [] CA . swanctl x509ca . cacert file handle . authorities..file [] . . cacert file handle . authorities..handle [] CKA_ID CA /. cacert file handle . authorities..slot [] CA . authorities..module [] PKCS#11. authorities..crl_uris [] (CRL) ( URI ldap http). authorities..ocsp_uris [] URI OCSP. authorities..cert_uri_base [] URI (Hash and URL) IKEv2 . IKEv2 DER . SHA1 DER URI . /etc/swanctl/swanctl.conf swanctl(8) 6.1.0 SWANCTL.CONF(5)