2 Section defining IKE connection configurations.
4 Section defining IKE connection configurations.
6 The connections section defines IKE connection configurations, each in
7 its own subsections. In the keyword description below, the connection
8 is named _<conn>_, but an arbitrary yet unique connection name can be
9 chosen for each connection subsection.
11 connections.<conn> { # }
12 Section for an IKE connection named <conn>.
14 connections.<conn>.version = 0
15 IKE major version to use for connection.
17 IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
18 uses IKEv2. A connection using the default of _0_ accepts both IKEv1
19 and IKEv2 as responder, and initiates the connection actively with IKEv2.
21 connections.<conn>.local_addrs = %any
22 Local address(es) to use for IKE communication, comma separated.
24 Local address(es) to use for IKE communication, comma separated. Takes
25 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
27 As initiator, the first non-range/non-subnet is used to initiate the
28 connection from. As responder, the local destination address must match at
29 least to one of the specified addresses, subnets or ranges.
31 connections.<conn>.remote_addrs = %any
32 Remote address(es) to use for IKE communication, comma separated.
34 Remote address(es) to use for IKE communication, comma separated. Takes
35 single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
37 As initiator, the first non-range/non-subnet is used to initiate the
38 connection to. As responder, the initiator source address must match at
39 least to one of the specified addresses, subnets or ranges.
41 To initiate a connection, at least one specific address or DNS name must
44 connections.<conn>.local_port = 500
45 Local UDP port for IKE communication.
47 Local UDP port for IKE communication. By default the port of the socket
48 backend is used, which is usually _500_. If port _500_ is used, automatic
49 IKE port floating to port 4500 is used to work around NAT issues.
51 Using a non-default local IKE port requires support from the socket backend
52 in use (socket-dynamic).
54 connections.<conn>.remote_port = 500
55 Remote UDP port for IKE communication.
57 Remote UDP port for IKE communication. If the default of port _500_ is used,
58 automatic IKE port floating to port 4500 is used to work around NAT issues.
60 connections.<conn>.proposals = default
61 Comma separated proposals to accept for IKE.
63 A proposal is a set of algorithms. For non-AEAD algorithms, this includes
64 for IKE an encryption algorithm, an integrity algorithm, a pseudo random
65 function and a Diffie-Hellman group. For AEAD algorithms, instead of
66 encryption and integrity algorithms, a combined algorithm is used.
68 In IKEv2, multiple algorithms of the same kind can be specified in a single
69 proposal, from which one gets selected. In IKEv1, only one algorithm per
70 kind is allowed per proposal, more algorithms get implicitly stripped. Use
71 multiple proposals to offer different algorithms combinations in IKEv1.
73 Algorithm keywords get separated using dashes. Multiple proposals may be
74 separated by commas. The special value _default_ forms a default proposal
75 of supported algorithms considered safe, and is usually a good choice
78 connections.<conn>.vips =
79 Virtual IPs to request in configuration payload / Mode Config.
81 Comma separated list of virtual IPs to request in IKEv2 configuration
82 payloads or IKEv1 Mode Config. The wildcard addresses _0.0.0.0_ and _::_
83 request an arbitrary address, specific addresses may be defined. The
84 responder may return a different address, though, or none at all.
86 connections.<conn>.aggressive = no
87 Use Aggressive Mode in IKEv1.
89 Enables Aggressive Mode instead of Main Mode with Identity Protection.
90 Aggressive Mode is considered less secure, because the ID and HASH
91 payloads are exchanged unprotected. This allows a passive attacker to
92 snoop peer identities, and even worse, start dictionary attacks on the
95 connections.<conn>.pull = yes
96 Set the Mode Config mode to use.
98 If the default of _yes_ is used, Mode Config works in pull mode, where
99 the initiator actively requests a virtual IP. With _no_, push mode is used,
100 where the responder pushes down a virtual IP to the initiating peer.
102 Push mode is currently supported for IKEv1, but not in IKEv2. It is used
103 by a few implementations only, pull mode is recommended.
105 connections.<conn>.encap = no
106 Enforce UDP encapsulation by faking NAT-D payloads.
108 To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
109 NAT detection payloads. This makes the peer believe that NAT takes
110 place on the path, forcing it to encapsulate ESP packets in UDP.
112 Usually this is not required, but it can help to work around connectivity
113 issues with too restrictive intermediary firewalls.
115 connections.<conn>.mobike = yes
116 Enables MOBIKE on IKEv2 connections.
118 Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
119 connections, and allows mobility of clients and multi-homing on servers by
120 migrating active IPsec tunnels.
122 Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
123 peer does not indicate support for it. However, due to the design of MOBIKE,
124 IKEv2 always floats to port 4500 starting from the second exchange. Some
125 implementations don't like this behavior, hence it can be disabled.
127 connections.<conn>.dpd_delay = 0s
128 Interval of liveness checks (DPD).
130 Interval to check the liveness of a peer actively using IKEv2 INFORMATIONAL
131 exchanges or IKEv1 R_U_THERE messages. Active DPD checking is only enforced
132 if no IKE or ESP/AH packet has been received for the configured DPD delay.
134 connections.<conn>.dpd_timeout = 0s
135 Timeout for DPD checks (IKEV1 only).
137 Charon by default uses the normal retransmission mechanism and timeouts to
138 check the liveness of a peer, as all messages are used for liveness
139 checking. For compatibility reasons, with IKEv1 a custom interval may be
140 specified; this option has no effect on connections using IKE2.
142 connections.<conn>.fragmentation = no
143 Use IKE UDP datagram fragmentation. (_yes_, _no_ or _force_).
145 Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
146 fragmentation). Acceptable values are _yes_, _force_ and _no_ (the
147 default). Fragmented IKE messages sent by a peer are always accepted
148 irrespective of the value of this option. If set to _yes_, and the peer
149 supports it, oversized IKE messages will be sent in fragments. If set to
150 _force_ (only supported for IKEv1) the initial IKE message will already
151 be fragmented if required.
153 connections.<conn>.send_certreq = yes
154 Send certificate requests payloads (_yes_ or _no_).
156 Send certificate request payloads to offer trusted root CA certificates
157 to the peer. Certificate requests help the peer to choose an appropriate
158 certificate/private key for authentication and are enabled by default.
160 Disabling certificate requests can be useful if too many trusted root CA
161 certificates are installed, as each certificate request increases the size
162 of the initial IKE packets.
164 connections.<conn>.send_cert = ifasked
165 Send certificate payloads (_always_, _never_ or _ifasked_).
167 Send certificate payloads when using certificate authentication. With the
168 default of _ifasked_ the daemon sends certificate payloads only if
169 certificate requests have been received. _never_ disables sending of
170 certificate payloads altogether, _always_ causes certificate payloads to be
171 sent unconditionally whenever certificate authentication is used.
173 connections.<conn>.keyingtries = 1
174 Number of retransmission sequences to perform during initial connect.
176 Number of retransmission sequences to perform during initial connect.
177 Instead of giving up initiation after the first retransmission sequence with
178 the default value of _1_, additional sequences may be started according to
179 the configured value. A value of _0_ initiates a new sequence until the
180 connection establishes or fails with a permanent error.
182 connections.<conn>.unique = no
183 Connection uniqueness policy (_never_, _no_, _keep_ or _replace_).
185 Connection uniqueness policy to enforce. To avoid multiple connections
186 from the same user, a uniqueness policy can be enforced. The value _never_
187 does never enforce such a policy, even if a peer included INITIAL_CONTACT
188 notification messages, whereas _no_ replaces existing connections for the
189 same identity if a new one has the INITIAL_CONTACT notify. _keep_ rejects
190 new connection attempts if the same user already has an active connection,
191 _replace_ deletes any existing connection if a new one for the same user
194 To compare connections for uniqueness, the remote IKE identity is used. If
195 EAP or XAuth authentication is involved, the EAP-Identity or XAuth username
196 is used to enforce the uniqueness policy instead.
198 On initiators this setting specifies whether an INITIAL_CONTACT notify is
199 sent during IKE_AUTH if no existing connection is found with the remote
200 peer (determined by the identities of the first authentication round).
201 Only if set to _keep_ or _replace_ will the client send a notify.
203 connections.<conn>.reauth_time = 0s
204 Time to schedule IKE reauthentication.
206 Time to schedule IKE reauthentication. IKE reauthentication recreates the
207 IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
208 configurations (with EAP or configuration payloads) it might not be possible
209 to actively reauthenticate as responder. The IKEv2 reauthentication lifetime
210 negotiation can instruct the client to perform reauthentication.
212 Reauthentication is disabled by default. Enabling it usually may lead
213 to small connection interruptions, as strongSwan uses a break-before-make
214 policy with IKEv2 to avoid any conflicts with associated tunnel resources.
216 connections.<conn>.rekey_time = 4h
217 Time to schedule IKE rekeying.
219 IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
220 does not re-check associated credentials. It is supported in IKEv2 only,
221 IKEv1 performs a reauthentication procedure instead.
223 With the default value IKE rekeying is scheduled every 4 hours, minus the
224 configured **rand_time**. If a **reauth_time** is configured, **rekey_time**
225 defaults to zero disabling rekeying; explicitly set both to enforce
226 rekeying and reauthentication.
228 connections.<conn>.over_time = 10% of rekey_time/reauth_time
229 Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
231 Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
232 To avoid having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying
233 fails perpetually, a maximum hard lifetime may be specified. If the
234 IKE_SA fails to rekey or reauthenticate within the specified time, the
237 In contrast to CHILD_SA rekeying, **over_time** is relative in time to the
238 **rekey_time** _and_ **reauth_time** values, as it applies to both.
240 The default is 10% of the longer of **rekey_time** and **reauth_time**.
242 connections.<conn>.rand_time = over_time
243 Range of random time to subtract from rekey/reauth times.
245 Time range from which to choose a random value to subtract from
246 rekey/reauth times. To avoid having both peers initiating the rekey/reauth
247 procedure simultaneously, a random time gets subtracted from the
250 The default is equal to the configured **over_time**.
252 connections.<conn>.pools =
253 Comma separated list of named IP pools.
255 Comma separated list of named IP pools to allocate virtual IP addresses and
256 other configuration attributes from. Each name references a pool by name
257 from either the **pools** section or an external pool.
259 connections.<conn>.local<suffix> {}
260 Section for a local authentication round.
262 Section for a local authentication round. A local authentication round
263 defines the rules how authentication is performed for the local peer.
264 Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple Authentication
267 Each round is defined in a section having _local_ as prefix, and an optional
268 unique suffix. To define a single authentication round, the suffix may be
271 connections.<conn>.local<suffix>.certs =
272 Comma separated list of certificate candidates to use for authentication.
274 Comma separated list of certificate candidates to use for authentication.
275 The certificates may use a relative path from the **swanctl** _x509_
276 directory or an absolute path.
278 The certificate used for authentication is selected based on the received
279 certificate request payloads. If no appropriate CA can be located, the
280 first certificate is used.
282 connections.<conn>.local<suffix>.pubkeys =
283 Comma separated list of raw public key candidates to use for authentication.
285 Comma separated list of raw public key candidates to use for authentication.
286 The public keys may use a relative path from the **swanctl** _pubkey_
287 directory or an absolute path.
289 Even though multiple local public keys could be defined in principle, only
290 the first public key in the list is used for authentication.
292 connections.<conn>.local<suffix>.auth = pubkey
293 Authentication to perform locally (_pubkey_, _psk_, _xauth[-backend]_ or
296 Authentication to perform locally. _pubkey_ uses public key authentication
297 using a private key associated to a usable certificate. _psk_ uses
298 pre-shared key authentication. The IKEv1 specific _xauth_ is used for
299 XAuth or Hybrid authentication, while the IKEv2 specific _eap_ keyword
300 defines EAP authentication.
302 For _xauth_, a specific backend name may be appended, separated by a dash.
303 The appropriate _xauth_ backend is selected to perform the XAuth exchange.
304 For traditional XAuth, the _xauth_ method is usually defined in the second
305 authentication round following an initial _pubkey_ (or _psk_) round. Using
306 _xauth_ in the first round performs Hybrid Mode client authentication.
308 For _eap_, a specific EAP method name may be appended, separated by a dash.
309 An EAP module implementing the appropriate method is selected to perform
310 the EAP conversation.
312 connections.<conn>.local<suffix>.id =
313 IKE identity to use for authentication round.
315 IKE identity to use for authentication round. When using certificate
316 authentication, the IKE identity must be contained in the certificate,
317 either as subject or as subjectAltName.
319 The identity can be an IP address, a fully-qualified domain name, an email
320 address or a Distinguished Name for which the ID type is determined
321 automatically and the string is converted to the appropriate encoding. To
322 enforce a specific identity type, a prefix may be used, followed by a colon
323 (:). If the number sign (#) follows the colon, the remaining data is
324 interpreted as hex encoding, otherwise the string is used as-is as the
325 identification data. Note that this implies that no conversion is performed
326 for non-string identities. For example, _ipv4:10.0.0.1_ does not create a
327 valid ID_IPV4_ADDR IKE identity, as it does not get converted to binary
328 0x0a000001. Instead, one could use _ipv4:#0a000001_ to get a valid identity,
329 but just using the implicit type with automatic conversion is usually
330 simpler. The same applies to the ASN1 encoded types. The following prefixes
331 are known: _ipv4_, _ipv6_, _rfc822_, _email_, _userfqdn_, _fqdn_, _dns_,
332 _asn1dn_, _asn1gn_ and _keyid_. Custom type prefixes may be specified by
333 surrounding the numerical type value by curly brackets.
335 connections.<conn>.local<suffix>.eap_id = id
336 Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
338 connections.<conn>.local<suffix>.aaa_id = remote-id
339 Server side EAP-Identity to expect in the EAP method.
341 Server side EAP-Identity to expect in the EAP method. Some EAP methods, such
342 as EAP-TLS, use an identity for the server to perform mutual authentication.
343 This identity may differ from the IKE identity, especially when EAP
344 authentication is delegated from the IKE responder to an AAA backend.
346 For EAP-(T)TLS, this defines the identity for which the server must provide
347 a certificate in the TLS exchange.
349 connections.<conn>.local<suffix>.xauth_id = id
350 Client XAuth username used in the XAuth exchange.
352 connections.<conn>.remote<suffix> {}
353 Section for a remote authentication round.
355 Section for a remote authentication round. A remote authentication round
356 defines the constraints how the peers must authenticate to use this
357 connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
358 Authentication or IKEv1 XAuth.
360 Each round is defined in a section having _remote_ as prefix, and an
361 optional unique suffix. To define a single authentication round, the suffix
364 connections.<conn>.remote<suffix>.id = %any
365 IKE identity to expect for authentication round.
367 IKE identity to expect for authentication round. Refer to the _local_ _id_
370 connections.<conn>.remote<suffix>.groups =
371 Authorization group memberships to require.
373 Comma separated authorization group memberships to require. The peer must
374 prove membership to at least one of the specified groups. Group membership
375 can be certified by different means, for example by appropriate Attribute
376 Certificates or by an AAA backend involved in the authentication.
378 connections.<conn>.remote<suffix>.certs =
379 Comma separated list of certificate to accept for authentication.
381 Comma separated list of certificates to accept for authentication.
382 The certificates may use a relative path from the **swanctl** _x509_
383 directory or an absolute path.
385 connections.<conn>.remote<suffix>.cacerts =
386 Comma separated list of CA certificates to accept for authentication.
388 Comma separated list of CA certificates to accept for authentication.
389 The certificates may use a relative path from the **swanctl** _x509ca_
390 directory or an absolute path.
392 connections.<conn>.remote<suffix>.pubkeys =
393 Comma separated list of raw public keys to accept for authentication.
395 Comma separated list of raw public keys to accept for authentication.
396 The public keys may use a relative path from the **swanctl** _x509_
397 directory or an absolute path.
399 connections.<conn>.remote<suffix>.revocation = relaxed
400 Certificate revocation policy, (_strict_, _ifuri_ or _relaxed_).
402 Certificate revocation policy for CRL or OCSP revocation.
404 A _strict_ revocation policy fails if no revocation information is
405 available, i.e. the certificate is not known to be unrevoked.
407 _ifuri_ fails only if a CRL/OCSP URI is available, but certificate
408 revocation checking fails, i.e. there should be revocation information
409 available, but it could not be obtained.
411 The default revocation policy _relaxed_ fails only if a certificate
412 is revoked, i.e. it is explicitly known that it is bad.
414 connections.<conn>.remote<suffix>.auth = pubkey
415 Authentication to expect from remote (_pubkey_, _psk_, _xauth[-backend]_ or
418 Authentication to expect from remote. See the **local** sections **auth**
419 keyword description about the details of supported mechanisms.
421 connections.<conn>.children.<child> {}
422 CHILD_SA configuration sub-section.
424 CHILD_SA configuration sub-section. Each connection definition may have
425 one or more sections in its _children_ subsection. The section name
426 defines the name of the CHILD_SA configuration, which must be unique within
429 connections.<conn>.children.<child>.ah_proposals =
430 AH proposals to offer for the CHILD_SA.
432 AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
433 For AH, this includes an integrity algorithm and an optional Diffie-Hellman
434 group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
435 negotiation uses a separate Diffie-Hellman exchange using the specified
438 In IKEv2, multiple algorithms of the same kind can be specified in a single
439 proposal, from which one gets selected. In IKEv1, only one algorithm per
440 kind is allowed per proposal, more algorithms get implicitly stripped. Use
441 multiple proposals to offer different algorithms combinations in IKEv1.
443 Algorithm keywords get separated using dashes. Multiple proposals may be
444 separated by commas. The special value _default_ forms a default proposal
445 of supported algorithms considered safe, and is usually a good choice
446 for interoperability. By default no AH proposals are included, instead ESP
449 connections.<conn>.children.<child>.esp_proposals = default
450 ESP proposals to offer for the CHILD_SA.
452 ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
453 For ESP non-AEAD proposals, this includes an integrity algorithm, an
454 encryption algorithm, an optional Diffie-Hellman group and an optional
455 Extended Sequence Number Mode indicator. For AEAD proposals, a combined
456 mode algorithm is used instead of the separate encryption/integrity
459 If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial (non
460 IKE_AUTH piggybacked) negotiation uses a separate Diffie-Hellman exchange
461 using the specified group. Extended Sequence Number support may be indicated
462 with the _esn_ and _noesn_ values, both may be included to indicate support
463 for both modes. If omitted, _noesn_ is assumed.
465 In IKEv2, multiple algorithms of the same kind can be specified in a single
466 proposal, from which one gets selected. In IKEv1, only one algorithm per
467 kind is allowed per proposal, more algorithms get implicitly stripped. Use
468 multiple proposals to offer different algorithms combinations in IKEv1.
470 Algorithm keywords get separated using dashes. Multiple proposals may be
471 separated by commas. The special value _default_ forms a default proposal
472 of supported algorithms considered safe, and is usually a good choice
473 for interoperability. If no algorithms are specified for AH nor ESP,
474 the _default_ set of algorithms for ESP is included.
476 connections.<conn>.children.<child>.local_ts = dynamic
477 Local traffic selectors to include in CHILD_SA.
479 Comma separated list of local traffic selectors to include in CHILD_SA.
480 Each selector is a CIDR subnet definition, followed by an optional
481 proto/port selector. The special value _dynamic_ may be used instead of a
482 subnet definition, which gets replaced by the tunnel outer address or the
483 virtual IP, if negotiated. This is the default.
485 A protocol/port selector is surrounded by opening and closing square
486 brackets. Between these brackets, a numeric or **getservent**(3) protocol
487 name may be specified. After the optional protocol restriction, an optional
488 port restriction may be specified, separated by a slash. The port
489 restriction may be numeric, a **getservent**(3) service name, or the special
490 value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
491 as well, none of the kernel backends currently support port ranges, though.
493 Unless the Unity extension is used, IKEv1 supports the first specified
494 selector only. IKEv1 uses very similar traffic selector narrowing as it is
495 supported in the IKEv2 protocol.
497 connections.<conn>.children.<child>.remote_ts = dynamic
498 Remote selectors to include in CHILD_SA.
500 Comma separated list of remote selectors to include in CHILD_SA. See
501 **local_ts** for a description of the selector syntax.
503 connections.<conn>.children.<child>.rekey_time = 1h
504 Time to schedule CHILD_SA rekeying.
506 Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
507 material, optionally using a Diffie-Hellman exchange if a group is
508 specified in the proposal.
510 To avoid rekey collisions initiated by both ends simultaneously, a value
511 in the range of **rand_time** gets subtracted to form the effective soft
514 By default CHILD_SA rekeying is scheduled every hour, minus **rand_time**.
516 connections.<conn>.children.<child>.life_time = rekey_time + 10%
517 Maximum lifetime before CHILD_SA gets closed, as time.
519 Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
520 is never reached, because the CHILD_SA gets rekeyed before.
521 If that fails for whatever reason, this limit closes the CHILD_SA.
523 The default is 10% more than the **rekey_time**.
525 connections.<conn>.children.<child>.rand_time = life_time - rekey_time
526 Range of random time to subtract from **rekey_time**.
528 Time range from which to choose a random value to subtract from
529 **rekey_time**. The default is the difference between **life_time** and
532 connections.<conn>.children.<child>.rekey_bytes = 0
533 Number of bytes processed before initiating CHILD_SA rekeying.
535 Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
536 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
537 if a group is specified in the proposal.
539 To avoid rekey collisions initiated by both ends simultaneously, a value
540 in the range of **rand_bytes** gets subtracted to form the effective soft
543 Volume based CHILD_SA rekeying is disabled by default.
545 connections.<conn>.children.<child>.life_bytes = rekey_bytes + 10%
546 Maximum bytes processed before CHILD_SA gets closed.
548 Maximum bytes processed before CHILD_SA gets closed. Usually this hard
549 volume limit is never reached, because the CHILD_SA gets rekeyed before.
550 If that fails for whatever reason, this limit closes the CHILD_SA.
552 The default is 10% more than **rekey_bytes**.
554 connections.<conn>.children.<child>.rand_bytes = life_bytes - rekey_bytes
555 Range of random bytes to subtract from **rekey_bytes**.
557 Byte range from which to choose a random value to subtract from
558 **rekey_bytes**. The default is the difference between **life_bytes** and
561 connections.<conn>.children.<child>.rekey_packets = 0
562 Number of packets processed before initiating CHILD_SA rekeying.
564 Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
565 rekeying refreshes key material, optionally using a Diffie-Hellman exchange
566 if a group is specified in the proposal.
568 To avoid rekey collisions initiated by both ends simultaneously, a value
569 in the range of **rand_packets** gets subtracted to form the effective soft
572 Packet count based CHILD_SA rekeying is disabled by default.
574 connections.<conn>.children.<child>.life_packets = rekey_packets + 10%
575 Maximum number of packets processed before CHILD_SA gets closed.
577 Maximum number of packets processed before CHILD_SA gets closed. Usually
578 this hard packets limit is never reached, because the CHILD_SA gets rekeyed
579 before. If that fails for whatever reason, this limit closes the CHILD_SA.
581 The default is 10% more than **rekey_bytes**.
583 connections.<conn>.children.<child>.rand_packets = life_packets - rekey_packets
584 Range of random packets to subtract from **packets_bytes**.
586 Packet range from which to choose a random value to subtract from
587 **rekey_packets**. The default is the difference between **life_packets**
588 and **rekey_packets**.
590 connections.<conn>.children.<child>.updown =
591 Updown script to invoke on CHILD_SA up and down events.
593 connections.<conn>.children.<child>.hostaccess = yes
594 Hostaccess variable to pass to **updown** script.
596 connections.<conn>.children.<child>.mode = tunnel
597 IPsec Mode to establish (_tunnel_, _transport_, _beet_, _pass_ or _drop_).
599 IPsec Mode to establish CHILD_SA with. _tunnel_ negotiates the CHILD_SA
600 in IPsec Tunnel Mode, whereas _transport_ uses IPsec Transport Mode. _beet_
601 is the Bound End to End Tunnel mixture mode, working with fixed inner
602 addresses without the need to include them in each packet.
604 Both _transport_ and _beet_ modes are subject to mode negotiation; _tunnel_
605 mode is negotiated if the preferred mode is not available.
607 _pass_ and _drop_ are used to install shunt policies which explicitly
608 bypass the defined traffic from IPsec processing or drop it, respectively.
610 connections.<conn>.children.<child>.policies = yes
611 Whether to install IPsec policies or not.
613 Whether to install IPsec policies or not. Disabling this can be useful in
614 some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon.
616 connections.<conn>.children.<child>.dpd_action = clear
617 Action to perform on DPD timeout (_clear_, _trap_ or _restart_).
619 Action to perform for this CHILD_SA on DPD timeout. The default _clear_
620 closes the CHILD_SA and does not take further action. _trap_ installs
621 a trap policy, which will catch matching traffic and tries to re-negotiate
622 the tunnel on-demand. _restart_ immediately tries to re-negotiate the
623 CHILD_SA under a fresh IKE_SA.
625 connections.<conn>.children.<child>.ipcomp = no
626 Enable IPComp compression before encryption.
628 Enable IPComp compression before encryption. If enabled, IKE tries to
629 negotiate IPComp compression to compress ESP payload data prior to
632 connections.<conn>.children.<child>.inactivity = 0s
633 Timeout before closing CHILD_SA after inactivity.
635 Timeout before closing CHILD_SA after inactivity. If no traffic has
636 been processed in either direction for the configured timeout, the CHILD_SA
637 gets closed due to inactivity. The default value of _0_ disables inactivity
640 connections.<conn>.children.<child>.reqid = 0
641 Fixed reqid to use for this CHILD_SA.
643 Fixed reqid to use for this CHILD_SA. This might be helpful in some
644 scenarios, but works only if each CHILD_SA configuration is instantiated
645 not more than once. The default of _0_ uses dynamic reqids, allocated
648 connections.<conn>.children.<child>.mark_in = 0/0x00000000
649 Netfilter mark and mask for input traffic.
651 Netfilter mark and mask for input traffic. On Linux Netfilter may require
652 marks on each packet to match an SA having that option set. This allows
653 Netfilter rules to select specific tunnels for incoming traffic. The
654 special value _%unique_ sets a unique mark on each CHILD_SA instance.
656 An additional mask may be appended to the mark, separated by _/_. The
657 default mask if omitted is 0xffffffff.
659 connections.<conn>.children.<child>.mark_out = 0/0x00000000
660 Netfilter mark and mask for output traffic.
662 Netfilter mark and mask for output traffic. On Linux Netfilter may require
663 marks on each packet to match a policy having that option set. This allows
664 Netfilter rules to select specific tunnels for outgoing traffic. The
665 special value _%unique_ sets a unique mark on each CHILD_SA instance.
667 An additional mask may be appended to the mark, separated by _/_. The
668 default mask if omitted is 0xffffffff.
670 connections.<conn>.children.<child>.tfc_padding = 0
671 Traffic Flow Confidentiality padding.
673 Pads ESP packets with additional data to have a consistent ESP packet size
674 for improved Traffic Flow Confidentiality. The padding defines the minimum
675 size of all ESP packets sent.
677 The default value of 0 disables TFC padding, the special value _mtu_ adds
678 TFC padding to create a packet size equal to the Path Maximum Transfer Unit.
680 connections.<conn>.children.<child>.replay_window = 32
681 IPsec replay window to configure for this CHILD_SA.
683 IPsec replay window to configure for this CHILD_SA. Larger values than the
684 default of 32 are supported using the Netlink backend only, a value of 0
685 disables IPsec replay protection.
687 connections.<conn>.children.<child>.start_action = none
688 Action to perform after loading the configuration (_none_, _trap_, _start_).
690 Action to perform after loading the configuration. The default of _none_
691 loads the connection only, which then can be manually initiated or used as
692 a responder configuration.
694 The value _trap_ installs a trap policy, which triggers the tunnel as soon
695 as matching traffic has been detected. The value _start_ initiates
696 the connection actively.
698 When unloading or replacing a CHILD_SA configuration having a
699 **start_action** different from _none_, the inverse action is performed.
700 Configurations with _start_ get closed, while such with _trap_ get
703 connections.<conn>.children.<child>.close_action = none
704 Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_).
706 Action to perform after a CHILD_SA gets closed by the peer. The default of
707 _none_ does not take any action, _trap_ installs a trap policy for the
708 CHILD_SA. _start_ tries to re-create the CHILD_SA.
710 **close_action** does not provide any guarantee that the CHILD_SA is kept
711 alive. It acts on explicit close messages only, but not on negotiation
712 failures. Use trap policies to reliably re-create failed CHILD_SAs.
715 Section defining secrets for IKE/EAP/XAuth authentication and private
718 Section defining secrets for IKE/EAP/XAuth authentication and private key
719 decryption. The **secrets** section takes sub-sections having a specific
720 prefix which defines the secret type.
722 It is not recommended to define any private key decryption passphrases,
723 as then there is no real security benefit in having encrypted keys. Either
724 store the key unencrypted or enter the keys manually when loading
727 secrets.eap<suffix> { # }
728 EAP secret section for a specific secret.
730 EAP secret section for a specific secret. Each EAP secret is defined in
731 a unique section having the _eap_ prefix. EAP secrets are used for XAuth
732 authentication as well.
734 secrets.xauth<suffix> { # }
735 XAuth secret section for a specific secret.
737 XAuth secret section for a specific secret. **xauth** is just an alias
738 for **eap**, secrets under both section prefixes are used for both EAP and
739 XAuth authentication.
741 secrets.eap<suffix>.secret =
742 Value of the EAP/XAuth secret.
744 Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
745 encoded string if it has a _0x_ prefix or a Base64 encoded string if it
746 has a _0s_ prefix in its value.
748 secrets.eap<suffix>.id<suffix> =
749 Identity the EAP/XAuth secret belongs to.
751 Identity the EAP/XAuth secret belongs to. Multiple unique identities may
752 be specified, each having an _id_ prefix, if a secret is shared between
755 secrets.ike<suffix> { # }
756 IKE preshared secret section for a specific secret.
758 IKE preshared secret section for a specific secret. Each IKE PSK is defined
759 in a unique section having the _ike_ prefix.
761 secrets.ike<suffix>.secret =
762 Value of the IKE preshared secret.
764 Value of the IKE preshared secret. It may either be an ASCII string,
765 a hex encoded string if it has a _0x_ prefix or a Base64 encoded string if
766 it has a _0s_ prefix in its value.
768 secrets.ike<suffix>.id<suffix> =
769 IKE identity the IKE preshared secret belongs to.
771 IKE identity the IKE preshared secret belongs to. Multiple unique identities
772 may be specified, each having an _id_ prefix, if a secret is shared between
775 secrets.rsa<suffix> { # }
776 Private key decryption passphrase for a key in the _rsa_ folder.
778 secrets.rsa<suffix>.file =
779 File name in the _rsa_ folder for which this passphrase should be used.
781 secrets.rsa<suffix>.secret
782 Value of decryption passphrase for RSA key.
784 secrets.ecdsa<suffix> { # }
785 Private key decryption passphrase for a key in the _ecdsa_ folder.
787 secrets.ecdsa<suffix>.file =
788 File name in the _ecdsa_ folder for which this passphrase should be used.
790 secrets.ecdsa<suffix>.secret
791 Value of decryption passphrase for ECDSA key.
793 secrets.pkcs8<suffix> { # }
794 Private key decryption passphrase for a key in the _pkcs8_ folder.
796 secrets.pkcs8<suffix>.file =
797 File name in the _pkcs8_ folder for which this passphrase should be used.
799 secrets.pkcs8<suffix>.secret
800 Value of decryption passphrase for PKCS#8 key.
802 secrets.pkcs12<suffix> { # }
803 PKCS#12 decryption passphrase for a container in the _pkcs12_ folder.
805 secrets.pkcs12<suffix>.file =
806 File name in the _pkcs12_ folder for which this passphrase should be used.
808 secrets.pkcs12<suffix>.secret
809 Value of decryption passphrase for PKCS#12 container.
812 Section defining named pools.
814 Section defining named pools. Named pools may be referenced by connections
815 with the **pools** option to assign virtual IPs and other configuration
819 Section defining a single pool with a unique name.
822 Addresses allocated in pool.
824 Subnet or range defining addresses allocated in pool. Accepts a single CIDR
825 subnet defining the pool to allocate addresses from or an address range
826 (<from>-<to>). Pools must be unique and non-overlapping.
828 pools.<name>.<attr> =
829 Comma separated list of additional attributes from type <attr>.
831 Comma separated list of additional attributes of type **<attr>**. The
832 attribute type may be one of _dns_, _nbns_, _dhcp_, _netmask_, _server_,
833 _subnet_, _split_include_ and _split_exclude_ to define addresses or CIDR
834 subnets for the corresponding attribute types. Alternatively, **<attr>** can
835 be a numerical identifier, for which string attribute values are accepted
839 Section defining attributes of certification authorities.
841 authorities.<name> { # }
842 Section defining a certification authority with a unique name.
844 authorities.<name>.cacert =
845 CA certificate belonging to the certification authority.
847 The certificates may use a relative path from the **swanctl** _x509ca_
848 directory or an absolute path.
850 authorities.<name>.crl_uris =
851 Comma-separated list of CRL distribution points
853 Comma-separated list of CRL distribution points (ldap, http, or file URI)
855 authorities.<name>.ocsp_uris =
856 Comma-separated list of OCSP URIs
858 Comma-separated list of OCSP URIs
860 authorities.<name>.cert_uri_base =
861 Defines the base URI for the Hash and URL feature supported by IKEv2.
863 Defines the base URI for the Hash and URL feature supported by IKEv2.
864 Instead of exchanging complete certificates, IKEv2 allows one to send an
865 URI that resolves to the DER encoded certificate. The certificate URIs are
866 built by appending the SHA1 hash of the DER encoded certificates to this