strongSwan

{{title(ipsec.conf Reference)}}

h1. ipsec.conf

strongSwan's _/etc/ipsec.conf_ configuration file consists of three different section types:

* [[ConfigSetupSection|config setup]] defines general configuration parameters
* [[ConnSection|conn <name>]] defines a connection
* [[CaSection|ca <name>]] defines a certification authority

There can be only one [[ConfigSetupSection|config setup]] section but
an unlimited number of [[ConnSection|conn]] and [[CaSection|ca]] sections.

All parameters belonging to a section must be indented by at least one space or tab
character. The rest of the line after a '#' character is treated as a comment.
Comments within a section must also be indented.

A line which contains *include* followed by a file name is replaced by the contents
of that file. If the file name is not a full pathname, it is considered to be relative
to the directory containing the including file. Such inclusions can be nested. The file
name may include wildcards, for example: @include ipsec.*.conf@

h2. Reusing Existing Parameters

All [[ConnSection|conn]] and [[CaSection|ca]] sections inherit the parameters defined in a @conn %default@
or @ca %default@ section, respectively.

Parameters defined in other [[ConnSection|conn]] or [[CaSection|ca]] sections may be included in a section
with the @also=othersection@ parameter.

h2. Example

<pre>
# /etc/ipsec.conf - strongSwan IPsec configuration file

config setup
cachecrls=yes
strictcrlpolicy=yes

ca strongswan #define alternative CRL distribution point
cacert=strongswanCert.pem
crluri=http://crl2.strongswan.org/strongswan.crl
auto=add

conn %default
keyingtries=1
keyexchange=ikev2

conn roadwarrior
leftsubnet=10.1.0.0/16
leftcert=moonCert.pem
leftid=@moon.strongswan.org
right=%any
auto=add
</pre>

h2. IKE and ESP Cipher Suites

* [[IKEv1CipherSuites|IKEv1 Cipher Suites]]
* [[IKEv2CipherSuites|IKEv2 Cipher Suites]]