strongSwan's /etc/ipsec.conf configuration file consists of three different section types:
- config setup defines general configuration parameters
- conn <name> defines a connection
- ca <name> defines a certification authority
All parameters belonging to a section must be indented by at least one space or tab
character. The rest of the line after a '#' character is treated as a comment.
Comments within a section must also be indented.
A line which contains include followed by a file name is replaced by the contents
of that file. If the file name is not a full pathname, it is considered to be relative
to the directory containing the including file. Such inclusions can be nested. The file
name may include wildcards, for example:
Reusing Existing Parameters¶
# /etc/ipsec.conf - strongSwan IPsec configuration file config setup cachecrls=yes strictcrlpolicy=yes ca strongswan #define alternative CRL distribution point cacert=strongswanCert.pem crluri=http://crl2.strongswan.org/strongswan.crl auto=add conn %default keyingtries=1 keyexchange=ikev2 conn roadwarrior leftsubnet=10.1.0.0/16 leftcert=moonCert.pem email@example.com right=%any auto=add