strongSwan

[Unit]
Description=strongSwan IPsec IKEv1/IKEv2 daemon using swanctl
Requires=network.target
After=network.target

[Service]
Type=notify
ExecStartPre=/usr/bin/ip xfrm policy flush
ExecStartPre=/usr/bin/ip xfrm state flush
ExecStartPre=/usr/bin/ip route flush table 220
ExecStart=/usr/bin/charon-systemd
ExecStartPost=/usr/bin/swanctl --load-all --noprompt
ExecReload=/usr/bin/swanctl --reload
Restart=on-failure

[Install]
WantedBy=multi-user.target

ll /var/log/charon.log*
-rw------- 1 root root    0 15. Jan 00:00 /var/log/charon.log
-rw------- 1 root root  76K 15. Jan 19:42 /var/log/charon.log.1
-rw------- 1 root root 880K 11. Nov 03:44 /var/log/charon.log.5.gz

/var/log/charon.log {

    missingok
    sharedscripts
    compress
    postrotate
        /usr/bin/killall -HUP /usr/bin/charon-systemd
        /usr/bin/killall -HUP /usr/lib/strongswan/charon
    endscript
}

charon-systemd {
        load = random nonce af-alg openssl x509 revocation constraints curl pubkey pkcs1 pkcs7 pkcs8 pem gmp attr kernel-netlink socket-default vici eap-identity eap-gtc eap-mschapv2 eap-radius xauth-generic xauth-eap unity eap-tls eap-ttls chapoly sha3 mgf1 bliss ntru newhope
        make_before_break=yes
        retransmit_tries = 6
        retransmit_timeout = 3.0
        retransmit_base = 1.7
        cisco_unity=yes
        dos_protection = yes
        threads = 32
        replay_window = 32
        retry_initiate_interval = 3
        interface_use = ens3
        send_vendor_id = yes
        crypt_test {
                on_add = yes
                required = yes
        }
        journal {
                time_format = %a, %Y-%m-%d %R
                default = 0
                append=yes
                ike_name=yes
                flush_line=yes
        }
        filelog {
                /var/log/charon.log {
                        time_format = %a, %Y-%m-%d %R
                        default = 2
                        mgr = 0
                        net = 1
                        enc = 1
                        asn = 1
                        job = 1
                        knl = 1
                        ike_name = yes
                        append = no
                }
        }
        plugins {
        }
        tls {
                ciphers = aes128, aes256
                key_exchange = ecdhe-ecdsa, ecdhe-rsa, dhe-rsa, rsa
                mac = sha256, sha384
        }
}

swanctl {
        load = test-vectors sqlite aes des rc2 sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl mysql af-alg fips-prf gmp xcbc cmac hmac ctr ccm gcm ntru curl
}