strongswan.conf¶

Overview¶

While the ipsec.conf configuration file is well suited to define
IPsec related configuration parameters, it is not useful for other strongSwan
applications to read options from this file. The file is hard to parse and
only starter is capable of doing so.

As the number of components of the strongSwan project is growing, we need a
more flexible configuration file, easy to extend and useable by all components.
The configuration format uses hierarchal sections and a list of key/value
pairs in each section.

Since 4.2.1, a default strongswan.conf gets installed in your
sysconfdir, e.g. /etc/strongswan.conf.

Syntax¶

Each section has a name, followed by C-Style curly brackets defining the
sections body. Each section body contains a set of subsections and key/value
pairs:

settings := (section|keyvalue)*
section  := name { settings }
keyvalue := key = value\n

Values must be terminated by a newline. Comments are possible using the
#-character, but be careful: The parser implementation is currently limited
and does not like brackets in comments. Section names and keys may contain
any printable character except:

. { } # \n \t space

An example might look like this:

a = b
section-one {
  somevalue = asdf
  subsection {
    othervalue = xxx
  }
  # yei, a comment 
  yetanother = zz
}
section-two {
  x = 12
}

Indentation is optional, you may use tabs or spaces.

Reading values¶

The config file is read by libstrongswan during library initialization. Values
are accessed using a dot-separated section list and a key:
Accessing section-one.subsection.othervalue will return xxx.

Have a look at the [source:trunk/src/libstrongswan/settings.h settings interface]
how to query values.

Defined keys¶

The following keys are currently defined (using dot notation).

Key	Default	Description
charon section
charon.close_ike_on_child_failure	no	Close the IKE_SA if setup of the CHILD_SA along with IKE_AUTH failed
charon.dh_exponent_ansi_x9_42 (< version 4.3.2)	yes	Use ANSI X9.42 DH exponent size or optimum size matched to cryptographical strength
charon.dns1		DNS server 1 assigned to peer via configuration payload (CP)
charon.dns2		DNS server 2 assigned to peer via configuration payload (CP)
charon.dos_protection	yes	Enable Denial of Service protection using cookies and aggressiveness checks
charon.hash_and_url	no	Enable hash and URL support
charon.install_routes	yes	Install routes into a separate routing table for established IPsec tunnels
charon.keep_alive	20s	NAT keep alive interval
charon.load		Plugins to load in charon
charon.multiple_authentication	yes	Enable multiple authentication exchanges (RFC 4739)
charon.process_route	yes	Process RTM_NEWROUTE and RTM_DELROUTE events
charon.reuse_ikesa	yes	Initiate CHILD_SA within existing IKE_SAs
charon.routing_table		Numerical routing table to install routes to
charon.routing_table_prio		Priority of the routing table
charon.threads	16	Number of worker threads in charon
charon.ikesa_table_size	1	Size of the IKE_SA hash table
charon.ikesa_table_segments	1	Number of exclusively locked segments in the hash table
charon.nbns1		WINS server 1 assigned to peer via configuration payload (CP)
charon.nbns2		WINS server 2 assigned to peer via configuration payload (CP)
charon.plugins.sql.database		Database URI for charons SQL plugin
charon.plugins.sql.lease_history	yes	Enable logging of SQL IP pool leases
charon.plugins.sql.loglevel	-1	Loglevel for logging to SQL database
charon.plugins.load_tester.enable	no	Enable the load testing plugin. Read LoadTests first!
charon.plugins.load_tester.initiators	0	Number of concurrent initiator threads to use in load test
charon.plugins.load_tester.iterations	1	Number of IKE_SAs to initate to self by each initiator in load test
charon.plugins.load_tester.delay	0	Delay between initiatons for each thread
charon.plugins.load_tester.proposal	aes128-sha1-modp1024	IKE proposal to use in load test
charon.plugins.load_tester.auth	pubkey	Authentication method to use, pubkey or psk
charon.plugins.load_tester.fake_kernel	no	Fake the kernel interface to allow load-testing against self
charon.plugins.load_tester.delete_after_established	no	Delete an IKE_SA as soon as it has been established
charon.plugins.load_tester.request_virtual_ip	no	Request an INTERNAL_IPV4_ADDR from the server
charon.plugins.load_tester.pool	NULL	Provide INTERNAL_IPV4_ADDRs from a named pool
charon.plugins.load_tester.remote	127.0.0.1	Address to initiation connections to
charon.plugins.load_tester.ike_rekey	0	Seconds to start IKE_SA rekeying after setup
charon.plugins.load_tester.child_rekey	600	Seconds to start CHILD_SA rekeying after setup
charon.plugins.eap_radius.secret		Shared secret between RADIUS and NAS
charon.plugins.eap_radius.server		IP/Hostname of RADIUS server
charon.plugins.eap_radius.port	1812	Port of RADIUS server (authentication)
charon.plugins.eap_radius.sockets	5	Number of sockets (ports) to use, increase for high load
charon.plugins.eap_radius.nas_identifier	strongSwan	NAS-Identifier to include in RADIUS messages
Flexible logger configuration		see LoggerConfiguration
libstrongswan section
libstrongswan.dh_exponent_ansi_x9_42	yes	Use ANSI X9.42 DH exponent size or optimum size matched to cryptographical strength
libstrongswan.crypto_test.on_add	no	Test crypto algorithms during registration
libstrongswan.crypto_test.on_create	no	Test crypto algorithms on each crypto primitive instantiation
libstrongswan.crypto_test.required	no	Strictly require at least one test vector to enable an algorithm
libstrongswan.crypto_test.rng_true	no	Whether to test RNG with TRUE quality; requires a lot of entropy
libstrongswan.ecp_x_coordinate_only	yes	Compliance with the errata for RFC 4753
libstrongswan.integrity_test	no	Check daemon, libstrongswan and plugin integrity at startup
libstrongswan.plugins.gcrypt.quick_random	no	Use faster random numbers in gcrypt; for testing only, produces weak keys!
manager section
manager.database		Credential database URI for manager
manager.debug	no	Enable debugging in manager
manager.load		Plugins to load in manager
manager.socket		FastCGI socket of manager, to run it statically
manager.threads	10	Threads to use for request handling
manager.timeout	15m	Session timeout for manager
mediation client section
medcli.database		Mediation client database URI
medcli.dpd	5m	DPD timeout to use in mediation client plugin
medcli.rekey	20m	Rekeying time on mediation connections in mediation client plugin
mediation server section
medsrv.database		Mediation server database URI
medsrv.debug	no	Debugging in mediation server web application
medsrv.dpd	5m	DPD timeout to use in mediation server plugin
medsrv.load		Plugins to load in mediation server plugin
medsrv.password_length	6	Minimum password length required for mediation server user accounts
medsrv.rekey	20m	Rekeying time on mediation connections in mediation server plugin
medsrv.socket		Run Mediation server web application statically on socket
medsrv.threads	5	Number of thread for mediation service web application
medsrv.timeout	15m	Session timeout for mediation service
openac section
openac.load		Plugins to load in ipsec openac tool
pluto section
pluto.dns1		DNS server 1 assigned to peer via configuration payload (CP)
pluto.dns2		DNS server 2 assigned to peer via configuration payload (CP)
pluto.load		Plugins to load in ipsec pluto daemon
pluto.nbns1		WINS server 1 assigned to peer via configuration payload (CP)
pluto.nbns2		WINS server 2 assigned to peer via configu+ration payload (CP)
pool section
pool.load		Plugins to load in ipsec pool tool
scepclient section
scepclient.load		Plugins to load in ipsec scepclient tool