strongSwan

h1. ipsec.conf



strongSwan's _/etc/ipsec.conf_ configuration file consists of three different section types:

* [[ConfigSetupSection|config setup]] defines general configuration parameters
* [[ConnSection|conn <name>]] defines a connection
* [[CaSection|ca <name>]] defines a certification authority

There can be only one [[ConfigSetupSection|config setup]] section but
an unlimited number of [[ConnSection|conn]] [[ConnSection|conn] and [[CaSection|ca]] [wikiCaSection ca]] sections.

All parameters belonging to a section must be indented by at least one space or tab
character. The rest of the line after a '#' character is treated as a comment.
Comments within a section must also be indented.



h2. Example



<pre>

# /etc/ipsec.conf - strongSwan IPsec configuration file

config setup
crlcheckinterval=600s
cachecrls=yes
strictcrlpolicy=yes
plutostart=no

ca strongswan #define alternative CRL distribution point
cacert=strongswanCert.pem
crluri=http://crl2.strongswan.org/strongswan.crl
auto=add

conn %default
keyingtries=1
keyexchange=ikev2

conn roadwarrior
left=192.168.0.1
leftsubnet=10.1.0.0/16
leftcert=moonCert.pem
leftid=@moon.strongswan.org
right=%any
auto=add
</pre>



h2. IKE and ESP Cipher Suites



* [[IKEv2CipherSuites|IKEv2 Cipher Suites]]