2 Section defining IKE connection configurations.
4 Section defining IKE connection configurations.
6 The connections section defines IKE connection configurations, each in
7 its own subsections. In the keyword description below, the connection
8 is named _<conn>_, but an arbitrary yet unique connection name can be
9 chosen for each connection subsection.
11 connections.<conn> { # }
12 Section for an IKE connection named <conn>.
14 connections.<conn>.version = 0
15 IKE major version to use for connection.
17 IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
18 uses IKEv2. A connection using the default of _0_ accepts both IKEv1
19 and IKEv2 as responder, and initiates the connection actively with IKEv2.
21 connections.<conn>.local_addrs = %any
22 Local address(es) to use for IKE communication, comma separated.
24 Local address(es) to use for IKE communication, comma separated. Takes
25 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
27 As initiator, the first non-range/non-subnet is used to initiate the
28 connection from. As responder, the local destination address must match at
29 least to one of the specified addresses, subnets or ranges.
31 If FQDNs are assigned they are resolved every time a configuration lookup
32 is done. If DNS resolution times out, the lookup is delayed for that time.
34 connections.<conn>.remote_addrs = %any
35 Remote address(es) to use for IKE communication, comma separated.
37 Remote address(es) to use for IKE communication, comma separated. Takes
38 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
40 As initiator, the first non-range/non-subnet is used to initiate the
41 connection to. As responder, the initiator source address must match at
42 least to one of the specified addresses, subnets or ranges.
44 If FQDNs are assigned they are resolved every time a configuration lookup
45 is done. If DNS resolution times out, the lookup is delayed for that time.
47 To initiate a connection, at least one specific address or DNS name must
50 connections.<conn>.local_port = 500
51 Local UDP port for IKE communication.
53 Local UDP port for IKE communication. By default the port of the socket
54 backend is used, which is usually _500_. If port _500_ is used, automatic
55 IKE port floating to port 4500 is used to work around NAT issues.
57 Using a non-default local IKE port requires support from the socket backend
58 in use (socket-dynamic).
60 connections.<conn>.remote_port = 500
61 Remote UDP port for IKE communication.
63 Remote UDP port for IKE communication. If the default of port _500_ is used,
64 automatic IKE port floating to port 4500 is used to work around NAT issues.
66 connections.<conn>.proposals = default
67 Comma separated proposals to accept for IKE.
69 A proposal is a set of algorithms. For non-AEAD algorithms, this includes
70 for IKE an encryption algorithm, an integrity algorithm, a pseudo random
71 function and a Diffie-Hellman group. For AEAD algorithms, instead of
72 encryption and integrity algorithms, a combined algorithm is used.
74 In IKEv2, multiple algorithms of the same kind can be specified in a single
75 proposal, from which one gets selected. In IKEv1, only one algorithm per
76 kind is allowed per proposal, more algorithms get implicitly stripped. Use
77 multiple proposals to offer different algorithms combinations in IKEv1.
79 Algorithm keywords get separated using dashes. Multiple proposals may be
80 separated by commas. The special value _default_ forms a default proposal
81 of supported algorithms considered safe, and is usually a good choice
84 connections.<conn>.vips =
85 Virtual IPs to request in configuration payload / Mode Config.
87 Comma separated list of virtual IPs to request in IKEv2 configuration
88 payloads or IKEv1 Mode Config. The wildcard addresses _0.0.0.0_ and _::_
89 request an arbitrary address, specific addresses may be defined. The
90 responder may return a different address, though, or none at all.
92 connections.<conn>.aggressive = no
93 Use Aggressive Mode in IKEv1.
95 Enables Aggressive Mode instead of Main Mode with Identity Protection.
96 Aggressive Mode is considered less secure, because the ID and HASH
97 payloads are exchanged unprotected. This allows a passive attacker to
98 snoop peer identities, and even worse, start dictionary attacks on the
101 connections.<conn>.pull = yes
102 Set the Mode Config mode to use.
104 If the default of _yes_ is used, Mode Config works in pull mode, where
105 the initiator actively requests a virtual IP. With _no_, push mode is used,
106 where the responder pushes down a virtual IP to the initiating peer.
108 Push mode is currently supported for IKEv1, but not in IKEv2. It is used
109 by a few implementations only, pull mode is recommended.
111 connections.<conn>.dscp = 000000
112 Differentiated Services Field Codepoint to set on outgoing IKE packets (six
115 Differentiated Services Field Codepoint to set on outgoing IKE packets for
116 this connection. The value is a six digit binary encoded string specifying
117 the Codepoint to set, as defined in RFC 2474.
119 connections.<conn>.encap = no
120 Enforce UDP encapsulation by faking NAT-D payloads.
122 To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
123 NAT detection payloads. This makes the peer believe that NAT takes
124 place on the path, forcing it to encapsulate ESP packets in UDP.
126 Usually this is not required, but it can help to work around connectivity
127 issues with too restrictive intermediary firewalls.
129 connections.<conn>.mobike = yes
130 Enables MOBIKE on IKEv2 connections.
132 Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
133 connections, and allows mobility of clients and multi-homing on servers by
134 migrating active IPsec tunnels.
136 Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
137 peer does not indicate support for it. However, due to the design of MOBIKE,
138 IKEv2 always floats to port 4500 starting from the second exchange. Some
139 implementations don't like this behavior, hence it can be disabled.
141 connections.<conn>.dpd_delay = 0s
142 Interval of liveness checks (DPD).
144 Interval to check the liveness of a peer actively using IKEv2 INFORMATIONAL
145 exchanges or IKEv1 R_U_THERE messages. Active DPD checking is only enforced
146 if no IKE or ESP/AH packet has been received for the configured DPD delay.
148 connections.<conn>.dpd_timeout = 0s
149 Timeout for DPD checks (IKEV1 only).
151 Charon by default uses the normal retransmission mechanism and timeouts to
152 check the liveness of a peer, as all messages are used for liveness
153 checking. For compatibility reasons, with IKEv1 a custom interval may be
154 specified; this option has no effect on connections using IKE2.
156 connections.<conn>.fragmentation = yes
157 Use IKE UDP datagram fragmentation. (_yes_, _accept_, _no_ or _force_).
159 Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
160 fragmentation). Acceptable values are _yes_ (the default), _accept_,
161 _force_ and _no_. If set to _yes_, and the peer supports it, oversized IKE
162 messages will be sent in fragments. If set to _accept_, support for
163 fragmentation is announced to the peer but the daemon does not send its own
164 messages in fragments. If set to _force_ (only supported for IKEv1) the
165 initial IKE message will already be fragmented if required. Finally, setting
166 the option to _no_ will disable announcing support for this feature.
168 Note that fragmented IKE messages sent by a peer are always accepted
169 irrespective of the value of this option (even when set to _no_).
171 connections.<conn>.send_certreq = yes
172 Send certificate requests payloads (_yes_ or _no_).
174 Send certificate request payloads to offer trusted root CA certificates
175 to the peer. Certificate requests help the peer to choose an appropriate
176 certificate/private key for authentication and are enabled by default.
178 Disabling certificate requests can be useful if too many trusted root CA
179 certificates are installed, as each certificate request increases the size
180 of the initial IKE packets.
182 connections.<conn>.send_cert = ifasked
183 Send certificate payloads (_always_, _never_ or _ifasked_).
185 Send certificate payloads when using certificate authentication. With the
186 default of _ifasked_ the daemon sends certificate payloads only if
187 certificate requests have been received. _never_ disables sending of
188 certificate payloads altogether, _always_ causes certificate payloads to be
189 sent unconditionally whenever certificate authentication is used.
191 connections.<conn>.keyingtries = 1
192 Number of retransmission sequences to perform during initial connect.
194 Number of retransmission sequences to perform during initial connect.
195 Instead of giving up initiation after the first retransmission sequence with
196 the default value of _1_, additional sequences may be started according to
197 the configured value. A value of _0_ initiates a new sequence until the
198 connection establishes or fails with a permanent error.
200 connections.<conn>.unique = no
201 Connection uniqueness policy (_never_, _no_, _keep_ or _replace_).
203 Connection uniqueness policy to enforce. To avoid multiple connections
204 from the same user, a uniqueness policy can be enforced. The value _never_
205 does never enforce such a policy, even if a peer included INITIAL_CONTACT
206 notification messages, whereas _no_ replaces existing connections for the
207 same identity if a new one has the INITIAL_CONTACT notify. _keep_ rejects
208 new connection attempts if the same user already has an active connection,
209 _replace_ deletes any existing connection if a new one for the same user
212 To compare connections for uniqueness, the remote IKE identity is used. If
213 EAP or XAuth authentication is involved, the EAP-Identity or XAuth username
214 is used to enforce the uniqueness policy instead.
216 On initiators this setting specifies whether an INITIAL_CONTACT notify is
217 sent during IKE_AUTH if no existing connection is found with the remote
218 peer (determined by the identities of the first authentication round).
219 Only if set to _keep_ or _replace_ will the client send a notify.
221 connections.<conn>.reauth_time = 0s
222 Time to schedule IKE reauthentication.
224 Time to schedule IKE reauthentication. IKE reauthentication recreates the
225 IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
226 configurations (with EAP or configuration payloads) it might not be possible
227 to actively reauthenticate as responder. The IKEv2 reauthentication lifetime
228 negotiation can instruct the client to perform reauthentication.
230 Reauthentication is disabled by default. Enabling it usually may lead
231 to small connection interruptions, as strongSwan uses a break-before-make
232 policy with IKEv2 to avoid any conflicts with associated tunnel resources.
234 connections.<conn>.rekey_time = 4h
235 Time to schedule IKE rekeying.
237 IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
238 does not re-check associated credentials. It is supported in IKEv2 only,
239 IKEv1 performs a reauthentication procedure instead.
241 With the default value IKE rekeying is scheduled every 4 hours, minus the
242 configured **rand_time**. If a **reauth_time** is configured, **rekey_time**
243 defaults to zero disabling rekeying; explicitly set both to enforce
244 rekeying and reauthentication.
246 connections.<conn>.over_time = 10% of rekey_time/reauth_time
247 Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
249 Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
250 To avoid having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying
251 fails perpetually, a maximum hard lifetime may be specified. If the
252 IKE_SA fails to rekey or reauthenticate within the specified time, the
255 In contrast to CHILD_SA rekeying, **over_time** is relative in time to the
256 **rekey_time** _and_ **reauth_time** values, as it applies to both.
258 The default is 10% of the longer of **rekey_time** and **reauth_time**.
260 connections.<conn>.rand_time = over_time
261 Range of random time to subtract from rekey/reauth times.
263 Time range from which to choose a random value to subtract from
264 rekey/reauth times. To avoid having both peers initiating the rekey/reauth
265 procedure simultaneously, a random time gets subtracted from the
268 The default is equal to the configured **over_time**.
270 connections.<conn>.pools =
271 Comma separated list of named IP pools.
273 Comma separated list of named IP pools to allocate virtual IP addresses and
274 other configuration attributes from. Each name references a pool by name
275 from either the **pools** section or an external pool.
277 connections.<conn>.mediation = no
278 Whether this connection is a mediation connection.
280 Whether this connection is a mediation connection, that is, whether this
281 connection is used to mediate other connections using the IKEv2 Mediation
282 Extension. Mediation connections create no CHILD_SA.
284 connections.<conn>.mediated_by =
285 The name of the connection to mediate this connection through.
287 The name of the connection to mediate this connection through. If given, the
288 connection will be mediated through the named mediation connection.
289 The mediation connection must have **mediation** enabled.
291 connections.<conn>.mediation_peer =
292 Identity under which the peer is registered at the mediation server.
294 Identity under which the peer is registered at the mediation server, that
295 is, the IKE identity the other end of this connection uses as its local
296 identity on its connection to the mediation server. This is the identity we
297 request the mediation server to mediate us with. Only relevant on
298 connections that set **mediated_by**. If it is not given, the remote IKE
299 identity of the first authentication round of this connection will be used.
301 connections.<conn>.local<suffix> {}
302 Section for a local authentication round.
304 Section for a local authentication round. A local authentication round
305 defines the rules how authentication is performed for the local peer.
306 Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple Authentication
309 Each round is defined in a section having _local_ as prefix, and an optional
310 unique suffix. To define a single authentication round, the suffix may be
313 connections.<conn>.local<suffix>.round = 0
314 Optional numeric identifier by which authentication rounds are sorted. If
315 not specified rounds are ordered by their position in the config file/VICI
318 connections.<conn>.local<suffix>.certs =
319 Comma separated list of certificate candidates to use for authentication.
321 Comma separated list of certificate candidates to use for authentication.
322 The certificates may use a relative path from the **swanctl** _x509_
323 directory or an absolute path.
325 The certificate used for authentication is selected based on the received
326 certificate request payloads. If no appropriate CA can be located, the
327 first certificate is used.
329 connections.<conn>.local<suffix>.cert<suffix> =
330 Section for a certificate candidate to use for authentication.
332 Section for a certificate candidate to use for authentication. Certificates
333 in _certs_ are transmitted as binary blobs, these sections offer more
336 connections.<conn>.local<suffix>.cert<suffix>.file =
337 Absolute path to the certificate to load.
339 Absolute path to the certificate to load. Passed as-is to the daemon, so it
340 must be readable by it.
342 Configure either this or _handle_, but not both, in one section.
344 connections.<conn>.local<suffix>.cert<suffix>.handle =
345 Hex-encoded CKA_ID of the certificate on a token.
347 Hex-encoded CKA_ID of the certificate on a token.
349 Configure either this or _file_, but not both, in one section.
351 connections.<conn>.local<suffix>.cert<suffix>.slot =
352 Optional slot number of the token that stores the certificate.
354 connections.<conn>.local<suffix>.cert<suffix>.module =
355 Optional PKCS#11 module name.
357 connections.<conn>.local<suffix>.pubkeys =
358 Comma separated list of raw public key candidates to use for authentication.
360 Comma separated list of raw public key candidates to use for authentication.
361 The public keys may use a relative path from the **swanctl** _pubkey_
362 directory or an absolute path.
364 Even though multiple local public keys could be defined in principle, only
365 the first public key in the list is used for authentication.
367 connections.<conn>.local<suffix>.auth = pubkey
368 Authentication to perform locally (_pubkey_, _psk_, _xauth[-backend]_ or
371 Authentication to perform locally. _pubkey_ uses public key authentication
372 using a private key associated to a usable certificate. _psk_ uses
373 pre-shared key authentication. The IKEv1 specific _xauth_ is used for
374 XAuth or Hybrid authentication, while the IKEv2 specific _eap_ keyword
375 defines EAP authentication.
377 For _xauth_, a specific backend name may be appended, separated by a dash.
378 The appropriate _xauth_ backend is selected to perform the XAuth exchange.
379 For traditional XAuth, the _xauth_ method is usually defined in the second
380 authentication round following an initial _pubkey_ (or _psk_) round. Using
381 _xauth_ in the first round performs Hybrid Mode client authentication.
383 For _eap_, a specific EAP method name may be appended, separated by a dash.
384 An EAP module implementing the appropriate method is selected to perform
385 the EAP conversation.
387 If both peers support RFC 7427 ("Signature Authentication in IKEv2")
388 specific hash algorithms to be used during IKEv2 authentication may be
389 configured. To do so use _ike:_ followed by a trust chain signature scheme
390 constraint (see description of the **remote** section's **auth** keyword).
391 For example, with _ike:pubkey-sha384-sha256_ a public key signature scheme
392 with either SHA-384 or SHA-256 would get used for authentication, in that
393 order and depending on the hash algorithms supported by the peer. If no
394 specific hash algorithms are configured, the default is to prefer an
395 algorithm that matches or exceeds the strength of the signature key.
396 If no constraints with _ike:_ prefix are configured any signature scheme
397 constraint (without _ike:_ prefix) will also apply to IKEv2 authentication,
398 unless this is disabled in **strongswan.conf**(5).
400 connections.<conn>.local<suffix>.id =
401 IKE identity to use for authentication round.
403 IKE identity to use for authentication round. When using certificate
404 authentication, the IKE identity must be contained in the certificate,
405 either as subject or as subjectAltName.
407 The identity can be an IP address, a fully-qualified domain name, an email
408 address or a Distinguished Name for which the ID type is determined
409 automatically and the string is converted to the appropriate encoding. To
410 enforce a specific identity type, a prefix may be used, followed by a colon
411 (:). If the number sign (#) follows the colon, the remaining data is
412 interpreted as hex encoding, otherwise the string is used as-is as the
413 identification data. Note that this implies that no conversion is performed
414 for non-string identities. For example, _ipv4:10.0.0.1_ does not create a
415 valid ID_IPV4_ADDR IKE identity, as it does not get converted to binary
416 0x0a000001. Instead, one could use _ipv4:#0a000001_ to get a valid identity,
417 but just using the implicit type with automatic conversion is usually
418 simpler. The same applies to the ASN1 encoded types. The following prefixes
419 are known: _ipv4_, _ipv6_, _rfc822_, _email_, _userfqdn_, _fqdn_, _dns_,
420 _asn1dn_, _asn1gn_ and _keyid_. Custom type prefixes may be specified by
421 surrounding the numerical type value by curly brackets.
423 connections.<conn>.local<suffix>.eap_id = id
424 Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
426 connections.<conn>.local<suffix>.aaa_id = remote-id
427 Server side EAP-Identity to expect in the EAP method.
429 Server side EAP-Identity to expect in the EAP method. Some EAP methods, such
430 as EAP-TLS, use an identity for the server to perform mutual authentication.
431 This identity may differ from the IKE identity, especially when EAP
432 authentication is delegated from the IKE responder to an AAA backend.
434 For EAP-(T)TLS, this defines the identity for which the server must provide
435 a certificate in the TLS exchange.
437 connections.<conn>.local<suffix>.xauth_id = id
438 Client XAuth username used in the XAuth exchange.
440 connections.<conn>.remote<suffix> {}
441 Section for a remote authentication round.
443 Section for a remote authentication round. A remote authentication round
444 defines the constraints how the peers must authenticate to use this
445 connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
446 Authentication or IKEv1 XAuth.
448 Each round is defined in a section having _remote_ as prefix, and an
449 optional unique suffix. To define a single authentication round, the suffix
452 connections.<conn>.remote<suffix>.round = 0
453 Optional numeric identifier by which authentication rounds are sorted. If
454 not specified rounds are ordered by their position in the config file/VICI
457 connections.<conn>.remote<suffix>.id = %any
458 IKE identity to expect for authentication round.
460 IKE identity to expect for authentication round. Refer to the _local_ _id_
463 connections.<conn>.remote<suffix>.eap_id = id
464 Identity to use as peer identity during EAP authentication.
466 Identity to use as peer identity during EAP authentication. If set to _%any_
467 the EAP-Identity method will be used to ask the client for an identity.
469 connections.<conn>.remote<suffix>.groups =
470 Authorization group memberships to require.
472 Comma separated authorization group memberships to require. The peer must
473 prove membership to at least one of the specified groups. Group membership
474 can be certified by different means, for example by appropriate Attribute
475 Certificates or by an AAA backend involved in the authentication.
477 connections.<conn>.remote<suffix>.cert_policy =
478 Certificate policy OIDs the peer's certificate must have.
480 Comma separated list of certificate policy OIDs the peer's certificate must
481 have. OIDs are specified using the numerical dotted representation.
483 connections.<conn>.remote<suffix>.certs =
484 Comma separated list of certificate to accept for authentication.
486 Comma separated list of certificates to accept for authentication.
487 The certificates may use a relative path from the **swanctl** _x509_
488 directory or an absolute path.
490 connections.<conn>.remote<suffix>.cert<suffix> =
491 Section for a certificate to accept for authentication.
493 Section for a certificate to accept for authentication. Certificates
494 in _certs_ are transmitted as binary blobs, these sections offer more
497 connections.<conn>.remote<suffix>.cert<suffix>.file =
498 Absolute path to the certificate to load.
500 Absolute path to the certificate to load. Passed as-is to the daemon, so it
501 must be readable by it.
503 Configure either this or _handle_, but not both, in one section.
505 connections.<conn>.remote<suffix>.cert<suffix>.handle =
506 Hex-encoded CKA_ID of the certificate on a token.
508 Hex-encoded CKA_ID of the certificate on a token.
510 Configure either this or _file_, but not both, in one section.
512 connections.<conn>.remote<suffix>.cert<suffix>.slot =
513 Optional slot number of the token that stores the certificate.
515 connections.<conn>.remote<suffix>.cert<suffix>.module =
516 Optional PKCS#11 module name.
518 connections.<conn>.remote<suffix>.cacerts =
519 Comma separated list of CA certificates to accept for authentication.
521 Comma separated list of CA certificates to accept for authentication.
522 The certificates may use a relative path from the **swanctl** _x509ca_
523 directory or an absolute path.
525 connections.<conn>.remote<suffix>.cacert<suffix> =
526 Section for a CA certificate to accept for authentication.
528 Section for a CA certificate to accept for authentication. Certificates
529 in _cacerts_ are transmitted as binary blobs, these sections offer more
532 connections.<conn>.remote<suffix>.cacert<suffix>.file =
533 Absolute path to the certificate to load.
535 Absolute path to the certificate to load. Passed as-is to the daemon, so it
536 must be readable by it.
538 Configure either this or _handle_, but not both, in one section.
540 connections.<conn>.remote<suffix>.cacert<suffix>.handle =
541 Hex-encoded CKA_ID of the CA certificate on a token.
543 Hex-encoded CKA_ID of the CA certificate on a token.
545 Configure either this or _file_, but not both, in one section.
547 connections.<conn>.remote<suffix>.cacert<suffix>.slot =
548 Optional slot number of the token that stores the CA certificate.
550 connections.<conn>.remote<suffix>.cacert<suffix>.module =
551 Optional PKCS#11 module name.
553 connections.<conn>.remote<suffix>.pubkeys =
554 Comma separated list of raw public keys to accept for authentication.
556 Comma separated list of raw public keys to accept for authentication.
557 The public keys may use a relative path from the **swanctl** _pubkey_
558 directory or an absolute path.
560 connections.<conn>.remote<suffix>.revocation = relaxed
561 Certificate revocation policy, (_strict_, _ifuri_ or _relaxed_).
563 Certificate revocation policy for CRL or OCSP revocation.
565 A _strict_ revocation policy fails if no revocation information is
566 available, i.e. the certificate is not known to be unrevoked.
568 _ifuri_ fails only if a CRL/OCSP URI is available, but certificate
569 revocation checking fails, i.e. there should be revocation information
570 available, but it could not be obtained.
572 The default revocation policy _relaxed_ fails only if a certificate
573 is revoked, i.e. it is explicitly known that it is bad.
575 connections.<conn>.remote<suffix>.auth = pubkey
576 Authentication to expect from remote (_pubkey_, _psk_, _xauth[-backend]_ or
579 Authentication to expect from remote. See the **local** section's **auth**
580 keyword description about the details of supported mechanisms.
582 To require a trustchain public key strength for the remote side, specify the
583 key type followed by the minimum strength in bits (for example _ecdsa-384_
584 or _rsa-2048-ecdsa-256_). To limit the acceptable set of hashing algorithms
585 for trustchain validation, append hash algorithms to _pubkey_ or a key
586 strength definition (for example _pubkey-sha1-sha256_ or
587 _rsa-2048-ecdsa-256-sha256-sha384-sha512_).
588 Unless disabled in **strongswan.conf**(5), or explicit IKEv2 signature
589 constraints are configured (refer to the description of the **local**
590 section's **auth** keyword for details), such key types and hash algorithms
591 are also applied as constraints against IKEv2 signature authentication
592 schemes used by the remote side.
594 To specify trust chain constraints for EAP-(T)TLS, append a colon to the
595 EAP method, followed by the key type/size and hash algorithm as discussed
596 above (e.g. _eap-tls:ecdsa-384-sha384_).
598 connections.<conn>.children.<child> {}
599 CHILD_SA configuration sub-section.
601 CHILD_SA configuration sub-section. Each connection definition may have
602 one or more sections in its _children_ subsection. The section name
603 defines the name of the CHILD_SA configuration, which must be unique within
606 connections.<conn>.children.<child>.ah_proposals =
607 AH proposals to offer for the CHILD_SA.
609 AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
610 For AH, this includes an integrity algorithm and an optional Diffie-Hellman
611 group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
612 negotiation uses a separate Diffie-Hellman exchange using the specified
613 group (refer to _esp_proposals_ for details).
615 In IKEv2, multiple algorithms of the same kind can be specified in a single
616 proposal, from which one gets selected. In IKEv1, only one algorithm per
617 kind is allowed per proposal, more algorithms get implicitly stripped. Use
618 multiple proposals to offer different algorithms combinations in IKEv1.
620 Algorithm keywords get separated using dashes. Multiple proposals may be
621 separated by commas. The special value _default_ forms a default proposal
622 of supported algorithms considered safe, and is usually a good choice
623 for interoperability. By default no AH proposals are included, instead ESP
626 connections.<conn>.children.<child>.esp_proposals = default
627 ESP proposals to offer for the CHILD_SA.
629 ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
630 For ESP non-AEAD proposals, this includes an integrity algorithm, an
631 encryption algorithm, an optional Diffie-Hellman group and an optional
632 Extended Sequence Number Mode indicator. For AEAD proposals, a combined
633 mode algorithm is used instead of the separate encryption/integrity
636 If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
637 negotiation use a separate Diffie-Hellman exchange using the specified
638 group. However, for IKEv2, the keys of the CHILD_SA created implicitly with
639 the IKE_SA will always be derived from the IKE_SA's key material. So any DH
640 group specified here will only apply when the CHILD_SA is later rekeyed or
641 is created with a separate CREATE_CHILD_SA exchange. A proposal mismatch
642 might, therefore, not immediately be noticed when the SA is established, but
643 may later cause rekeying to fail.
645 Extended Sequence Number support may be indicated with the _esn_ and _noesn_
646 values, both may be included to indicate support for both modes. If omitted,
649 In IKEv2, multiple algorithms of the same kind can be specified in a single
650 proposal, from which one gets selected. In IKEv1, only one algorithm per
651 kind is allowed per proposal, more algorithms get implicitly stripped. Use
652 multiple proposals to offer different algorithms combinations in IKEv1.
654 Algorithm keywords get separated using dashes. Multiple proposals may be
655 separated by commas. The special value _default_ forms a default proposal
656 of supported algorithms considered safe, and is usually a good choice
657 for interoperability. If no algorithms are specified for AH nor ESP,
658 the _default_ set of algorithms for ESP is included.
660 connections.<conn>.children.<child>.sha256_96 = no
661 Use incorrect 96-bit truncation for HMAC-SHA-256.
663 HMAC-SHA-256 is used with 128-bit truncation with IPsec. For compatibility
664 with implementations that incorrectly use 96-bit truncation this option may
665 be enabled to configure the shorter truncation length in the kernel. This
666 is not negotiated, so this only works with peers that use the incorrect
667 truncation length (or have this option enabled).
669 connections.<conn>.children.<child>.local_ts = dynamic
670 Local traffic selectors to include in CHILD_SA.
672 Comma separated list of local traffic selectors to include in CHILD_SA.
673 Each selector is a CIDR subnet definition, followed by an optional
674 proto/port selector. The special value _dynamic_ may be used instead of a
675 subnet definition, which gets replaced by the tunnel outer address or the
676 virtual IP, if negotiated. This is the default.
678 A protocol/port selector is surrounded by opening and closing square
679 brackets. Between these brackets, a numeric or **getservent**(3) protocol
680 name may be specified. After the optional protocol restriction, an optional
681 port restriction may be specified, separated by a slash. The port
682 restriction may be numeric, a **getservent**(3) service name, or the special
683 value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
684 as well, none of the kernel backends currently support port ranges, though.
686 When IKEv1 is used only the first selector is interpreted, except if
687 the Cisco Unity extension plugin is used. This is due to a limitation of the
688 IKEv1 protocol, which only allows a single pair of selectors per CHILD_SA.
689 So to tunnel traffic matched by several pairs of selectors when using IKEv1
690 several children (CHILD_SAs) have to be defined that cover the selectors.
692 The IKE daemon uses traffic selector narrowing for IKEv1, the same way it is
693 standardized and implemented for IKEv2. However, this may lead to problems
694 with other implementations. To avoid that, configure identical selectors in
697 connections.<conn>.children.<child>.remote_ts = dynamic
698 Remote selectors to include in CHILD_SA.
700 Comma separated list of remote selectors to include in CHILD_SA. See
701 **local_ts** for a description of the selector syntax.
703 connections.<conn>.children.<child>.rekey_time = 1h
704 Time to schedule CHILD_SA rekeying.
706 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
707 material, optionally using a Diffie-Hellman exchange if a group is
708 specified in the proposal.
710 To avoid rekey collisions initiated by both ends simultaneously, a value
711 in the range of **rand_time** gets subtracted to form the effective soft
714 By default CHILD_SA rekeying is scheduled every hour, minus **rand_time**.
716 connections.<conn>.children.<child>.life_time = rekey_time + 10%
717 Maximum lifetime before CHILD_SA gets closed, as time.
719 Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
720 is never reached, because the CHILD_SA gets rekeyed before.
721 If that fails for whatever reason, this limit closes the CHILD_SA.
723 The default is 10% more than the **rekey_time**.
725 connections.<conn>.children.<child>.rand_time = life_time - rekey_time
726 Range of random time to subtract from **rekey_time**.
728 Time range from which to choose a random value to subtract from
729 **rekey_time**. The default is the difference between **life_time** and
732 connections.<conn>.children.<child>.rekey_bytes = 0
733 Number of bytes processed before initiating CHILD_SA rekeying.
735 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
736 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
737 if a group is specified in the proposal.
739 To avoid rekey collisions initiated by both ends simultaneously, a value
740 in the range of **rand_bytes** gets subtracted to form the effective soft
743 Volume based CHILD_SA rekeying is disabled by default.
745 connections.<conn>.children.<child>.life_bytes = rekey_bytes + 10%
746 Maximum bytes processed before CHILD_SA gets closed.
748 Maximum bytes processed before CHILD_SA gets closed. Usually this hard
749 volume limit is never reached, because the CHILD_SA gets rekeyed before.
750 If that fails for whatever reason, this limit closes the CHILD_SA.
752 The default is 10% more than **rekey_bytes**.
754 connections.<conn>.children.<child>.rand_bytes = life_bytes - rekey_bytes
755 Range of random bytes to subtract from **rekey_bytes**.
757 Byte range from which to choose a random value to subtract from
758 **rekey_bytes**. The default is the difference between **life_bytes** and
761 connections.<conn>.children.<child>.rekey_packets = 0
762 Number of packets processed before initiating CHILD_SA rekeying.
764 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
765 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
766 if a group is specified in the proposal.
768 To avoid rekey collisions initiated by both ends simultaneously, a value
769 in the range of **rand_packets** gets subtracted to form the effective soft
772 Packet count based CHILD_SA rekeying is disabled by default.
774 connections.<conn>.children.<child>.life_packets = rekey_packets + 10%
775 Maximum number of packets processed before CHILD_SA gets closed.
777 Maximum number of packets processed before CHILD_SA gets closed. Usually
778 this hard packets limit is never reached, because the CHILD_SA gets rekeyed
779 before. If that fails for whatever reason, this limit closes the CHILD_SA.
781 The default is 10% more than **rekey_bytes**.
783 connections.<conn>.children.<child>.rand_packets = life_packets - rekey_packets
784 Range of random packets to subtract from **packets_bytes**.
786 Packet range from which to choose a random value to subtract from
787 **rekey_packets**. The default is the difference between **life_packets**
788 and **rekey_packets**.
790 connections.<conn>.children.<child>.updown =
791 Updown script to invoke on CHILD_SA up and down events.
793 connections.<conn>.children.<child>.hostaccess = yes
794 Hostaccess variable to pass to **updown** script.
796 connections.<conn>.children.<child>.mode = tunnel
797 IPsec Mode to establish (_tunnel_, _transport_, _transport_proxy_, _beet_,
800 IPsec Mode to establish CHILD_SA with. _tunnel_ negotiates the CHILD_SA
801 in IPsec Tunnel Mode, whereas _transport_ uses IPsec Transport Mode.
802 _transport_proxy_ signifying the special Mobile IPv6 Transport Proxy Mode.
803 _beet_ is the Bound End to End Tunnel mixture mode, working with fixed inner
804 addresses without the need to include them in each packet.
806 Both _transport_ and _beet_ modes are subject to mode negotiation; _tunnel_
807 mode is negotiated if the preferred mode is not available.
809 _pass_ and _drop_ are used to install shunt policies which explicitly
810 bypass the defined traffic from IPsec processing or drop it, respectively.
812 connections.<conn>.children.<child>.policies = yes
813 Whether to install IPsec policies or not.
815 Whether to install IPsec policies or not. Disabling this can be useful in
816 some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon.
818 connections.<conn>.children.<child>.policies_fwd_out = no
819 Whether to install outbound FWD IPsec policies or not.
821 Whether to install outbound FWD IPsec policies or not. Enabling this is
822 required in case there is a drop policy that would match and block forwarded
823 traffic for this CHILD_SA.
825 connections.<conn>.children.<child>.dpd_action = clear
826 Action to perform on DPD timeout (_clear_, _trap_ or _restart_).
828 Action to perform for this CHILD_SA on DPD timeout. The default _clear_
829 closes the CHILD_SA and does not take further action. _trap_ installs
830 a trap policy, which will catch matching traffic and tries to re-negotiate
831 the tunnel on-demand. _restart_ immediately tries to re-negotiate the
832 CHILD_SA under a fresh IKE_SA.
834 connections.<conn>.children.<child>.ipcomp = no
835 Enable IPComp compression before encryption.
837 Enable IPComp compression before encryption. If enabled, IKE tries to
838 negotiate IPComp compression to compress ESP payload data prior to
841 connections.<conn>.children.<child>.inactivity = 0s
842 Timeout before closing CHILD_SA after inactivity.
844 Timeout before closing CHILD_SA after inactivity. If no traffic has
845 been processed in either direction for the configured timeout, the CHILD_SA
846 gets closed due to inactivity. The default value of _0_ disables inactivity
849 connections.<conn>.children.<child>.reqid = 0
850 Fixed reqid to use for this CHILD_SA.
852 Fixed reqid to use for this CHILD_SA. This might be helpful in some
853 scenarios, but works only if each CHILD_SA configuration is instantiated
854 not more than once. The default of _0_ uses dynamic reqids, allocated
857 connections.<conn>.children.<child>.priority = 0
858 Optional fixed priority for IPsec policies.
860 Optional fixed priority for IPsec policies. This could be useful to install
861 high-priority drop policies. The default of _0_ uses dynamically calculated
862 priorities based on the size of the traffic selectors.
864 connections.<conn>.children.<child>.interface =
865 Optional interface name to restrict IPsec policies.
867 connections.<conn>.children.<child>.mark_in = 0/0x00000000
868 Netfilter mark and mask for input traffic.
870 Netfilter mark and mask for input traffic. On Linux Netfilter may require
871 marks on each packet to match an SA having that option set. This allows
872 Netfilter rules to select specific tunnels for incoming traffic. The
873 special value _%unique_ sets a unique mark on each CHILD_SA instance.
875 An additional mask may be appended to the mark, separated by _/_. The
876 default mask if omitted is 0xffffffff.
878 connections.<conn>.children.<child>.mark_out = 0/0x00000000
879 Netfilter mark and mask for output traffic.
881 Netfilter mark and mask for output traffic. On Linux Netfilter may require
882 marks on each packet to match a policy having that option set. This allows
883 Netfilter rules to select specific tunnels for outgoing traffic. The
884 special value _%unique_ sets a unique mark on each CHILD_SA instance.
886 An additional mask may be appended to the mark, separated by _/_. The
887 default mask if omitted is 0xffffffff.
889 connections.<conn>.children.<child>.tfc_padding = 0
890 Traffic Flow Confidentiality padding.
892 Pads ESP packets with additional data to have a consistent ESP packet size
893 for improved Traffic Flow Confidentiality. The padding defines the minimum
894 size of all ESP packets sent.
896 The default value of 0 disables TFC padding, the special value _mtu_ adds
897 TFC padding to create a packet size equal to the Path Maximum Transfer Unit.
899 connections.<conn>.children.<child>.replay_window = 32
900 IPsec replay window to configure for this CHILD_SA.
902 IPsec replay window to configure for this CHILD_SA. Larger values than the
903 default of 32 are supported using the Netlink backend only, a value of 0
904 disables IPsec replay protection.
906 connections.<conn>.children.<child>.hw_offload = no
907 Enable hardware offload for this CHILD_SA, if supported by the IPsec
910 connections.<conn>.children.<child>.start_action = none
911 Action to perform after loading the configuration (_none_, _trap_, _start_).
913 Action to perform after loading the configuration. The default of _none_
914 loads the connection only, which then can be manually initiated or used as
915 a responder configuration.
917 The value _trap_ installs a trap policy, which triggers the tunnel as soon
918 as matching traffic has been detected. The value _start_ initiates
919 the connection actively.
921 When unloading or replacing a CHILD_SA configuration having a
922 **start_action** different from _none_, the inverse action is performed.
923 Configurations with _start_ get closed, while such with _trap_ get
926 connections.<conn>.children.<child>.close_action = none
927 Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_).
929 Action to perform after a CHILD_SA gets closed by the peer. The default of
930 _none_ does not take any action, _trap_ installs a trap policy for the
931 CHILD_SA. _start_ tries to re-create the CHILD_SA.
933 **close_action** does not provide any guarantee that the CHILD_SA is kept
934 alive. It acts on explicit close messages only, but not on negotiation
935 failures. Use trap policies to reliably re-create failed CHILD_SAs.
938 Section defining secrets for IKE/EAP/XAuth authentication and private
941 Section defining secrets for IKE/EAP/XAuth authentication and private key
942 decryption. The **secrets** section takes sub-sections having a specific
943 prefix which defines the secret type.
945 It is not recommended to define any private key decryption passphrases,
946 as then there is no real security benefit in having encrypted keys. Either
947 store the key unencrypted or enter the keys manually when loading
950 secrets.eap<suffix> { # }
951 EAP secret section for a specific secret.
953 EAP secret section for a specific secret. Each EAP secret is defined in
954 a unique section having the _eap_ prefix. EAP secrets are used for XAuth
955 authentication as well.
957 secrets.xauth<suffix> { # }
958 XAuth secret section for a specific secret.
960 XAuth secret section for a specific secret. **xauth** is just an alias
961 for **eap**, secrets under both section prefixes are used for both EAP and
962 XAuth authentication.
964 secrets.eap<suffix>.secret =
965 Value of the EAP/XAuth secret.
967 Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
968 encoded string if it has a _0x_ prefix or a Base64 encoded string if it
969 has a _0s_ prefix in its value.
971 secrets.eap<suffix>.id<suffix> =
972 Identity the EAP/XAuth secret belongs to.
974 Identity the EAP/XAuth secret belongs to. Multiple unique identities may
975 be specified, each having an _id_ prefix, if a secret is shared between
978 secrets.ntlm<suffix> { # }
979 NTLM secret section for a specific secret.
981 NTLM secret section for a specific secret. Each NTLM secret is defined in
982 a unique section having the _ntlm_ prefix. NTLM secrets may only be used for
983 EAP-MSCHAPv2 authentication.
985 secrets.ntlm<suffix>.secret =
986 Value of the NTLM secret.
988 Value of the NTLM secret, which is the NT Hash of the actual secret, that
989 is, MD4(UTF-16LE(secret)). The resulting 16-byte value may either be given
990 as a hex encoded string with a _0x_ prefix or as a Base64 encoded string
993 secrets.ntlm<suffix>.id<suffix> =
994 Identity the NTLM secret belongs to.
996 Identity the NTLM secret belongs to. Multiple unique identities may
997 be specified, each having an _id_ prefix, if a secret is shared between
1000 secrets.ike<suffix> { # }
1001 IKE preshared secret section for a specific secret.
1003 IKE preshared secret section for a specific secret. Each IKE PSK is defined
1004 in a unique section having the _ike_ prefix.
1006 secrets.ike<suffix>.secret =
1007 Value of the IKE preshared secret.
1009 Value of the IKE preshared secret. It may either be an ASCII string,
1010 a hex encoded string if it has a _0x_ prefix or a Base64 encoded string if
1011 it has a _0s_ prefix in its value.
1013 secrets.ike<suffix>.id<suffix> =
1014 IKE identity the IKE preshared secret belongs to.
1016 IKE identity the IKE preshared secret belongs to. Multiple unique identities
1017 may be specified, each having an _id_ prefix, if a secret is shared between
1020 secrets.private<suffix> { # }
1021 Private key decryption passphrase for a key in the _private_ folder.
1023 secrets.private<suffix>.file =
1024 File name in the _private_ folder for which this passphrase should be used.
1026 secrets.private<suffix>.secret
1027 Value of decryption passphrase for private key.
1029 secrets.rsa<suffix> { # }
1030 Private key decryption passphrase for a key in the _rsa_ folder.
1032 secrets.rsa<suffix>.file =
1033 File name in the _rsa_ folder for which this passphrase should be used.
1035 secrets.rsa<suffix>.secret
1036 Value of decryption passphrase for RSA key.
1038 secrets.ecdsa<suffix> { # }
1039 Private key decryption passphrase for a key in the _ecdsa_ folder.
1041 secrets.ecdsa<suffix>.file =
1042 File name in the _ecdsa_ folder for which this passphrase should be used.
1044 secrets.ecdsa<suffix>.secret
1045 Value of decryption passphrase for ECDSA key.
1047 secrets.pkcs8<suffix> { # }
1048 Private key decryption passphrase for a key in the _pkcs8_ folder.
1050 secrets.pkcs8<suffix>.file =
1051 File name in the _pkcs8_ folder for which this passphrase should be used.
1053 secrets.pkcs8<suffix>.secret
1054 Value of decryption passphrase for PKCS#8 key.
1056 secrets.pkcs12<suffix> { # }
1057 PKCS#12 decryption passphrase for a container in the _pkcs12_ folder.
1059 secrets.pkcs12<suffix>.file =
1060 File name in the _pkcs12_ folder for which this passphrase should be used.
1062 secrets.pkcs12<suffix>.secret
1063 Value of decryption passphrase for PKCS#12 container.
1065 secrets.token<suffix> { # }
1066 Definition for a private key that's stored on a token/smartcard.
1068 secrets.token<suffix>.handle =
1069 Hex-encoded CKA_ID of the private key on the token.
1071 secrets.token<suffix>.slot =
1072 Optional slot number to access the token.
1074 secrets.token<suffix>.module =
1075 Optional PKCS#11 module name to access the token.
1077 secrets.token<suffix>.pin =
1078 Optional PIN required to access the key on the token. If none is provided
1079 the user is prompted during an interactive --load-creds call.
1082 Section defining named pools.
1084 Section defining named pools. Named pools may be referenced by connections
1085 with the **pools** option to assign virtual IPs and other configuration
1089 Section defining a single pool with a unique name.
1091 pools.<name>.addrs =
1092 Addresses allocated in pool.
1094 Subnet or range defining addresses allocated in pool. Accepts a single CIDR
1095 subnet defining the pool to allocate addresses from or an address range
1096 (<from>-<to>). Pools must be unique and non-overlapping.
1098 pools.<name>.<attr> =
1099 Comma separated list of additional attributes from type <attr>.
1101 Comma separated list of additional attributes of type **<attr>**. The
1102 attribute type may be one of _dns_, _nbns_, _dhcp_, _netmask_, _server_,
1103 _subnet_, _split_include_ and _split_exclude_ to define addresses or CIDR
1104 subnets for the corresponding attribute types. Alternatively, **<attr>** can
1105 be a numerical identifier, for which string attribute values are accepted
1109 Section defining attributes of certification authorities.
1111 authorities.<name> { # }
1112 Section defining a certification authority with a unique name.
1114 authorities.<name>.cacert =
1115 CA certificate belonging to the certification authority.
1117 CA certificate belonging to the certification authority. The certificates
1118 may use a relative path from the **swanctl** _x509ca_ directory or an
1121 Configure one of _cacert_, _file_, or _handle_ per section.
1123 authorities.<name>.file =
1124 Absolute path to the certificate to load.
1126 Absolute path to the certificate to load. Passed as-is to the daemon, so it
1127 must be readable by it.
1129 Configure one of _cacert_, _file_, or _handle_ per section.
1131 authorities.<name>.handle =
1132 Hex-encoded CKA_ID of the CA certificate on a token.
1134 Hex-encoded CKA_ID of the CA certificate on a token.
1136 Configure one of _cacert_, _file_, or _handle_ per section.
1138 authorities.<name>.slot =
1139 Optional slot number of the token that stores the CA certificate.
1141 authorities.<name>.module =
1142 Optional PKCS#11 module name.
1144 authorities.<name>.crl_uris =
1145 Comma-separated list of CRL distribution points.
1147 Comma-separated list of CRL distribution points (ldap, http, or file URI).
1149 authorities.<name>.ocsp_uris =
1150 Comma-separated list of OCSP URIs.
1152 authorities.<name>.cert_uri_base =
1153 Defines the base URI for the Hash and URL feature supported by IKEv2.
1155 Defines the base URI for the Hash and URL feature supported by IKEv2.
1156 Instead of exchanging complete certificates, IKEv2 allows one to send an
1157 URI that resolves to the DER encoded certificate. The certificate URIs are
1158 built by appending the SHA1 hash of the DER encoded certificates to this
1161 include conf.d/*.conf
1162 Include config snippets
projects / strongswan.git / blob