src/swanctl/swanctl.opt

   1 connections { # }
   2         Section defining IKE connection configurations.
   3
   4         Section defining IKE connection configurations.
   5
   6         The connections section defines IKE connection configurations, each in
   7         its own subsections. In the keyword description below, the connection
   8         is named _<conn>_, but an arbitrary yet unique connection name can be
   9         chosen for each connection subsection.
  10
  11 connections.<conn> { # }
  12         Section for an IKE connection named <conn>.
  13
  14 connections.<conn>.version = 0
  15         IKE major version to use for connection.
  16
  17         IKE major version to use for connection. _1_ uses IKEv1 aka ISAKMP, _2_
  18         uses IKEv2. A connection using the default of _0_ accepts both IKEv1
  19         and IKEv2 as responder, and initiates the connection actively with IKEv2.
  20
  21 connections.<conn>.local_addrs = %any
  22         Local address(es) to use for IKE communication, comma separated.
  23
  24         Local address(es) to use for IKE communication, comma separated. Takes
  25         single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
  26
  27         As initiator, the first non-range/non-subnet is used to initiate the
  28         connection from. As responder, the local destination address must match at
  29         least to one of the specified addresses, subnets or ranges.
  30
  31 connections.<conn>.remote_addrs = %any
  32         Remote address(es) to use for IKE communication, comma separated.
  33
  34         Remote address(es) to use for IKE communication, comma separated. Takes
  35         single IPv4/IPv6 addresses, DNS names, CIDR subnets or IP address ranges.
  36
  37         As initiator, the first non-range/non-subnet is used to initiate the
  38         connection to. As responder, the initiator source address must match at
  39         least to one of the specified addresses, subnets or ranges.
  40
  41         To initiate a connection, at least one specific address or DNS name must
  42         be specified.
  43
  44 connections.<conn>.local_port = 500
  45         Local UDP port for IKE communication.
  46
  47         Local UDP port for IKE communication. By default the port of the socket
  48         backend is used, which is usually _500_. If port _500_ is used, automatic
  49         IKE port floating to port 4500 is used to work around NAT issues.
  50
  51         Using a non-default local IKE port requires support from the socket backend
  52         in use (socket-dynamic).
  53
  54 connections.<conn>.remote_port = 500
  55         Remote UDP port for IKE communication.
  56
  57         Remote UDP port for IKE communication. If the default of port _500_ is used,
  58         automatic IKE port floating to port 4500 is used to work around NAT issues.
  59
  60 connections.<conn>.proposals = default
  61         Comma separated proposals to accept for IKE.
  62
  63         A proposal is a set of algorithms. For non-AEAD algorithms, this includes
  64         for IKE an encryption algorithm, an integrity algorithm, a pseudo random
  65         function and a Diffie-Hellman group. For AEAD algorithms, instead of
  66         encryption and integrity algorithms, a combined algorithm is used.
  67
  68         In IKEv2, multiple algorithms of the same kind can be specified in a single
  69         proposal, from which one gets selected. In IKEv1, only one algorithm per
  70         kind is allowed per proposal, more algorithms get implicitly stripped. Use
  71         multiple proposals to offer different algorithms combinations in IKEv1.
  72
  73         Algorithm keywords get separated using dashes. Multiple proposals may be
  74         separated by commas. The special value _default_ forms a default proposal
  75         of supported algorithms considered safe, and is usually a good choice
  76         for interoperability.
  77
  78 connections.<conn>.vips =
  79         Virtual IPs to request in configuration payload / Mode Config.
  80
  81         Comma separated list of virtual IPs to request in IKEv2 configuration
  82         payloads or IKEv1 Mode Config. The wildcard addresses _0.0.0.0_ and _::_
  83         request an arbitrary address, specific addresses may be defined. The
  84         responder may return a different address, though, or none at all.
  85
  86 connections.<conn>.aggressive = no
  87         Use Aggressive Mode in IKEv1.
  88
  89         Enables Aggressive Mode instead of Main Mode with Identity Protection.
  90         Aggressive Mode is considered less secure, because the ID and HASH
  91         payloads are exchanged unprotected. This allows a passive attacker to
  92         snoop peer identities, and even worse, start dictionary attacks on the
  93         Preshared Key.
  94
  95 connections.<conn>.pull = yes
  96         Set the Mode Config mode to use.
  97
  98         If the default of _yes_ is used, Mode Config works in pull mode, where
  99         the initiator actively requests a virtual IP. With _no_, push mode is used,
 100         where the responder pushes down a virtual IP to the initiating peer.
 101
 102         Push mode is currently supported for IKEv1, but not in IKEv2. It is used
 103         by a few implementations only, pull mode is recommended.
 104
 105 connections.<conn>.encap = no
 106         Enforce UDP encapsulation by faking NAT-D payloads.
 107
 108         To enforce UDP encapsulation of ESP packets, the IKE daemon can fake the
 109         NAT detection payloads. This makes the peer believe that NAT takes
 110         place on the path, forcing it to encapsulate ESP packets in UDP.
 111
 112         Usually this is not required, but it can help to work around connectivity
 113         issues with too restrictive intermediary firewalls.
 114
 115 connections.<conn>.mobike = yes
 116         Enables MOBIKE on IKEv2 connections.
 117
 118         Enables MOBIKE on IKEv2 connections. MOBIKE is enabled by default on IKEv2
 119         connections, and allows mobility of clients and multi-homing on servers by
 120         migrating active IPsec tunnels.
 121
 122         Usually keeping MOBIKE enabled is unproblematic, as it is not used if the
 123         peer does not indicate support for it. However, due to the design of MOBIKE,
 124         IKEv2 always floats to port 4500 starting from the second exchange. Some
 125         implementations don't like this behavior, hence it can be disabled.
 126
 127 connections.<conn>.dpd_delay = 0s
 128         Interval of liveness checks (DPD).
 129
 130         Interval to check the liveness of a peer actively using IKEv2 INFORMATIONAL
 131         exchanges or IKEv1 R_U_THERE messages. Active DPD checking is only enforced
 132         if no IKE or ESP/AH packet has been received for the configured DPD delay.
 133
 134 connections.<conn>.dpd_timeout = 0s
 135         Timeout for DPD checks (IKEV1 only).
 136
 137         Charon by default uses the normal retransmission mechanism and timeouts to
 138         check the liveness of a peer, as all messages are used for liveness
 139         checking. For compatibility reasons, with IKEv1 a custom interval may be
 140         specified; this option has no effect on connections using IKE2.
 141
 142 connections.<conn>.fragmentation = no
 143         Use IKE UDP datagram fragmentation.  (_yes_, _no_ or _force_).
 144
 145         Use IKE fragmentation (proprietary IKEv1 extension or RFC 7383 IKEv2
 146         fragmentation).  Acceptable  values  are _yes_, _force_ and _no_ (the
 147         default). Fragmented IKE messages sent by a peer are always accepted
 148         irrespective of  the  value  of  this option. If set to _yes_, and the peer
 149         supports it, oversized IKE messages will be sent in fragments.  If set  to
 150         _force_  (only  supported  for IKEv1) the initial IKE message will already
 151         be fragmented if required.
 152
 153 connections.<conn>.send_certreq = yes
 154         Send certificate requests payloads (_yes_ or _no_).
 155
 156         Send certificate request payloads to offer trusted root CA certificates
 157         to the peer. Certificate requests help the peer to choose an appropriate
 158         certificate/private key for authentication and are enabled by default.
 159
 160         Disabling certificate requests can be useful if too many trusted root CA
 161         certificates are installed, as each certificate request increases the size
 162         of the initial IKE packets.
 163
 164 connections.<conn>.send_cert = ifasked
 165         Send certificate payloads (_always_, _never_ or _ifasked_).
 166
 167         Send certificate payloads when using certificate authentication. With the
 168         default of _ifasked_ the daemon sends certificate payloads only if
 169         certificate requests have been received. _never_ disables sending of
 170         certificate payloads altogether, _always_ causes certificate payloads to be
 171         sent unconditionally whenever certificate authentication is used.
 172
 173 connections.<conn>.keyingtries = 1
 174         Number of retransmission sequences to perform during initial connect.
 175
 176         Number of retransmission sequences to perform during initial connect.
 177         Instead of giving up initiation after the first retransmission sequence with
 178         the default value of _1_, additional sequences may be started according to
 179         the configured value. A value of _0_ initiates a new sequence until the
 180         connection establishes or fails with a permanent error.
 181
 182 connections.<conn>.unique = no
 183         Connection uniqueness policy (_never_, _no_, _keep_ or _replace_).
 184
 185         Connection uniqueness policy to enforce. To avoid multiple connections
 186         from the same user, a uniqueness policy can be enforced. The value _never_
 187         does never enforce such a policy, even if a peer included INITIAL_CONTACT
 188         notification messages, whereas _no_ replaces existing connections for the
 189         same identity if a new one has the INITIAL_CONTACT notify. _keep_ rejects
 190         new connection attempts if the same user already has an active connection,
 191         _replace_ deletes any existing connection if a new one for the same user
 192         gets established.
 193
 194         To compare connections for uniqueness, the remote IKE identity is used. If
 195         EAP or XAuth authentication is involved, the EAP-Identity or XAuth username
 196         is used to enforce the uniqueness policy instead.
 197
 198         On initiators this setting specifies whether an INITIAL_CONTACT notify is
 199         sent during IKE_AUTH if no existing connection is found with the remote
 200         peer (determined by the identities of the first authentication round).
 201         Only if set to _keep_ or _replace_ will the client send a notify.
 202
 203 connections.<conn>.reauth_time = 0s
 204         Time to schedule IKE reauthentication.
 205
 206         Time to schedule IKE reauthentication. IKE reauthentication recreates the
 207         IKE/ISAKMP SA from scratch and re-evaluates the credentials. In asymmetric
 208         configurations (with EAP or configuration payloads) it might not be possible
 209         to actively reauthenticate as responder. The IKEv2 reauthentication lifetime
 210         negotiation can instruct the client to perform reauthentication.
 211
 212         Reauthentication is disabled by default. Enabling it usually may lead
 213         to small connection interruptions, as strongSwan uses a break-before-make
 214         policy with IKEv2 to avoid any conflicts with associated tunnel resources.
 215
 216 connections.<conn>.rekey_time = 4h
 217         Time to schedule IKE rekeying.
 218
 219         IKE rekeying refreshes key material using a Diffie-Hellman exchange, but
 220         does not re-check associated credentials. It is supported in IKEv2 only,
 221         IKEv1 performs a reauthentication procedure instead.
 222
 223         With the default value IKE rekeying is scheduled every 4 hours, minus the
 224         configured **rand_time**. If a **reauth_time** is configured, **rekey_time**
 225         defaults to zero disabling rekeying; explicitly set both to enforce
 226         rekeying and reauthentication.
 227
 228 connections.<conn>.over_time = 10% of rekey_time/reauth_time
 229         Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
 230
 231         Hard IKE_SA lifetime if rekey/reauth does not complete, as time.
 232         To avoid having an IKE/ISAKMP kept alive if IKE reauthentication or rekeying
 233         fails perpetually, a maximum hard lifetime may be specified. If the
 234         IKE_SA fails to rekey or reauthenticate within the specified time, the
 235         IKE_SA gets closed.
 236
 237         In contrast to CHILD_SA rekeying, **over_time** is relative in time to the
 238         **rekey_time** _and_ **reauth_time** values, as it applies to both.
 239
 240         The default is 10% of the longer of **rekey_time** and **reauth_time**.
 241
 242 connections.<conn>.rand_time = over_time
 243         Range of random time to subtract from rekey/reauth times.
 244
 245         Time range from which to choose a random value to subtract from
 246         rekey/reauth times. To avoid having both peers initiating the rekey/reauth
 247         procedure simultaneously, a random time gets subtracted from the
 248         rekey/reauth times.
 249
 250         The default is equal to the configured **over_time**.
 251
 252 connections.<conn>.pools =
 253         Comma separated list of named IP pools.
 254
 255         Comma separated list of named IP pools to allocate virtual IP addresses and
 256         other configuration attributes from. Each name references a pool by name
 257         from either the **pools** section or an external pool.
 258
 259 connections.<conn>.local<suffix> {}
 260         Section for a local authentication round.
 261
 262         Section for a local authentication round. A local authentication round
 263         defines the rules how authentication is performed for the local peer.
 264         Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple Authentication
 265         or IKEv1 XAuth.
 266
 267         Each round is defined in a section having _local_ as prefix, and an optional
 268         unique suffix. To define a single authentication round, the suffix may be
 269         omitted.
 270
 271 connections.<conn>.local<suffix>.certs =
 272         Comma separated list of certificate candidates to use for authentication.
 273
 274         Comma separated list of certificate candidates to use for authentication.
 275         The certificates may use a relative path from the **swanctl** _x509_
 276         directory or an absolute path.
 277
 278         The certificate used for authentication is selected based on the received
 279         certificate request payloads. If no appropriate CA can be located, the
 280         first certificate is used.
 281
 282 connections.<conn>.local<suffix>.pubkeys =
 283         Comma separated list of raw public key candidates to use for authentication.
 284
 285         Comma separated list of raw public key candidates to use for authentication.
 286         The public keys may use a relative path from the **swanctl** _pubkey_
 287         directory or an absolute path.
 288
 289         Even though multiple local public keys could be defined in principle, only
 290         the     first public key in the list is used for authentication.
 291
 292 connections.<conn>.local<suffix>.auth = pubkey
 293         Authentication to perform locally (_pubkey_, _psk_, _xauth[-backend]_ or
 294         _eap[-method]_).
 295
 296         Authentication to perform locally. _pubkey_ uses public key authentication
 297         using a private key associated to a usable certificate. _psk_ uses
 298         pre-shared key authentication. The IKEv1 specific _xauth_ is used for
 299         XAuth or Hybrid authentication, while the IKEv2 specific _eap_ keyword
 300         defines EAP authentication.
 301
 302         For _xauth_, a specific backend name may be appended, separated by a dash.
 303         The appropriate _xauth_ backend is selected to perform the XAuth exchange.
 304         For traditional XAuth, the _xauth_ method is usually defined in the second
 305         authentication round following an initial _pubkey_ (or _psk_) round. Using
 306         _xauth_ in the first round performs Hybrid Mode client authentication.
 307
 308         For _eap_, a specific EAP method name may be appended, separated by a dash.
 309         An EAP module implementing the appropriate method is selected to perform
 310         the EAP conversation.
 311
 312         If both peers support RFC 7427 ("Signature Authentication in IKEv2")
 313         specific hash algorithms to be used during IKEv2 authentication may be
 314         configured. To do so use _ike:_ followed by a trust chain signature scheme
 315         constraint (see description of the **remote** section's **auth** keyword).
 316         For example, with _ike:pubkey-sha384-sha256_ a public key signature scheme
 317         with either SHA-384 or SHA-256 would get used for authentication, in that
 318         order and depending on the hash algorithms supported by the peer. If no
 319         specific hash algorithms are configured, the default is to prefer an
 320         algorithm that matches or exceeds the strength of the signature key.
 321         If no constraints with _ike:_ prefix are configured any signature scheme
 322         constraint (without _ike:_ prefix) will also apply to IKEv2 authentication,
 323         unless this is disabled in **strongswan.conf**(5).
 324
 325 connections.<conn>.local<suffix>.id =
 326         IKE identity to use for authentication round.
 327
 328         IKE identity to use for authentication round. When using certificate
 329         authentication, the IKE identity must be contained in the certificate,
 330         either as subject or as subjectAltName.
 331
 332         The identity can be an IP address, a fully-qualified domain name, an email
 333         address or a Distinguished Name for which the ID type is determined
 334         automatically and the string is converted to the appropriate encoding. To
 335         enforce a specific identity type, a prefix may be used, followed by a colon
 336         (:). If the number sign (#) follows the colon, the remaining data is
 337         interpreted as hex encoding, otherwise the string is used as-is as the
 338         identification data. Note that this implies that no conversion is performed
 339         for non-string identities. For example, _ipv4:10.0.0.1_ does not create a
 340         valid ID_IPV4_ADDR IKE identity, as it does not get converted to binary
 341         0x0a000001. Instead, one could use _ipv4:#0a000001_ to get a valid identity,
 342         but just using the implicit type with automatic conversion is usually
 343         simpler. The same applies to the ASN1 encoded types. The following prefixes
 344         are known: _ipv4_, _ipv6_, _rfc822_, _email_, _userfqdn_, _fqdn_, _dns_,
 345         _asn1dn_, _asn1gn_ and _keyid_. Custom type prefixes may be specified by
 346         surrounding the numerical type value by curly brackets.
 347
 348 connections.<conn>.local<suffix>.eap_id = id
 349         Client EAP-Identity to use in EAP-Identity exchange and the EAP method.
 350
 351 connections.<conn>.local<suffix>.aaa_id = remote-id
 352         Server side EAP-Identity to expect in the EAP method.
 353
 354         Server side EAP-Identity to expect in the EAP method. Some EAP methods, such
 355         as EAP-TLS, use an identity for the server to perform mutual authentication.
 356         This identity may differ from the IKE identity, especially when EAP
 357         authentication is delegated from the IKE responder to an AAA backend.
 358
 359         For EAP-(T)TLS, this defines the identity for which the server must provide
 360         a certificate in the TLS exchange.
 361
 362 connections.<conn>.local<suffix>.xauth_id = id
 363         Client XAuth username used in the XAuth exchange.
 364
 365 connections.<conn>.remote<suffix> {}
 366         Section for a remote authentication round.
 367
 368         Section for a remote authentication round. A remote authentication round
 369         defines the constraints how the peers must authenticate to use this
 370         connection. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple
 371         Authentication or IKEv1 XAuth.
 372
 373         Each round is defined in a section having _remote_ as prefix, and an
 374         optional unique suffix. To define a single authentication round, the suffix
 375         may be omitted.
 376
 377 connections.<conn>.remote<suffix>.id = %any
 378         IKE identity to expect for authentication round.
 379
 380         IKE identity to expect for authentication round. Refer to the _local_ _id_
 381         section for details.
 382
 383 connections.<conn>.remote<suffix>.groups =
 384         Authorization group memberships to require.
 385
 386         Comma separated authorization group memberships to require. The peer must
 387         prove membership to at least one of the specified groups. Group membership
 388         can be certified by different means, for example by appropriate Attribute
 389         Certificates or by an AAA backend involved in the authentication.
 390
 391 connections.<conn>.remote<suffix>.certs =
 392         Comma separated list of certificate to accept for authentication.
 393
 394         Comma separated list of certificates to accept for authentication.
 395         The certificates may use a relative path from the **swanctl** _x509_
 396         directory or an absolute path.
 397
 398 connections.<conn>.remote<suffix>.cacerts =
 399         Comma separated list of CA certificates to accept for authentication.
 400
 401         Comma separated list of CA certificates to accept for authentication.
 402         The certificates may use a relative path from the **swanctl** _x509ca_
 403         directory or an absolute path.
 404
 405 connections.<conn>.remote<suffix>.pubkeys =
 406         Comma separated list of raw public keys to accept for authentication.
 407
 408         Comma separated list of raw public keys to accept for authentication.
 409         The public keys may use a relative path from the **swanctl** _x509_
 410         directory or an absolute path.
 411
 412 connections.<conn>.remote<suffix>.revocation = relaxed
 413         Certificate revocation policy, (_strict_, _ifuri_ or _relaxed_).
 414
 415         Certificate revocation policy for CRL or OCSP revocation.
 416
 417         A _strict_ revocation policy fails if no revocation information is
 418         available, i.e. the certificate is not known to be unrevoked.
 419
 420         _ifuri_ fails only if a CRL/OCSP URI is available, but certificate
 421         revocation checking fails, i.e. there should be revocation information
 422         available, but it could not be obtained.
 423
 424         The default revocation policy _relaxed_ fails only if a certificate
 425         is revoked, i.e. it is explicitly known that it is bad.
 426
 427 connections.<conn>.remote<suffix>.auth = pubkey
 428         Authentication to expect from remote (_pubkey_, _psk_, _xauth[-backend]_ or
 429         _eap[-method]_).
 430
 431         Authentication to expect from remote. See the **local** section's **auth**
 432         keyword description about the details of supported mechanisms.
 433
 434         To require a trustchain public key strength for the remote side, specify the
 435         key type followed by the minimum strength in bits (for example _ecdsa-384_
 436         or _rsa-2048-ecdsa-256_). To limit the acceptable set of hashing algorithms
 437         for trustchain validation, append hash algorithms to _pubkey_ or a key
 438         strength definition (for example _pubkey-sha1-sha256_ or
 439         _rsa-2048-ecdsa-256-sha256-sha384-sha512_).
 440         Unless disabled in **strongswan.conf**(5), or explicit IKEv2 signature
 441         constraints are configured (refer to the description of the **local**
 442         section's **auth** keyword for details), such key types and hash algorithms
 443         are also applied as constraints against IKEv2 signature authentication
 444         schemes used by the remote side.
 445
 446         To specify trust chain constraints for EAP-(T)TLS, append a colon to the
 447         EAP method, followed by the key type/size and hash algorithm as discussed
 448         above (e.g. _eap-tls:ecdsa-384-sha384_).
 449
 450 connections.<conn>.children.<child> {}
 451         CHILD_SA configuration sub-section.
 452
 453         CHILD_SA configuration sub-section. Each connection definition may have
 454         one or more sections in its _children_ subsection. The section name
 455         defines the name of the CHILD_SA configuration, which must be unique within
 456         the connection.
 457
 458 connections.<conn>.children.<child>.ah_proposals =
 459         AH proposals to offer for the CHILD_SA.
 460
 461         AH proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
 462         For AH, this includes an integrity algorithm and an optional Diffie-Hellman
 463         group. If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial
 464         negotiation uses a separate Diffie-Hellman exchange using the specified
 465         group.
 466
 467         In IKEv2, multiple algorithms of the same kind can be specified in a single
 468         proposal, from which one gets selected. In IKEv1, only one algorithm per
 469         kind is allowed per proposal, more algorithms get implicitly stripped. Use
 470         multiple proposals to offer different algorithms combinations in IKEv1.
 471
 472         Algorithm keywords get separated using dashes. Multiple proposals may be
 473         separated by commas. The special value _default_ forms a default proposal
 474         of supported algorithms considered safe, and is usually a good choice
 475         for interoperability. By default no AH proposals are included, instead ESP
 476         is proposed.
 477
 478 connections.<conn>.children.<child>.esp_proposals = default
 479         ESP proposals to offer for the CHILD_SA.
 480
 481         ESP proposals to offer for the CHILD_SA. A proposal is a set of algorithms.
 482         For ESP non-AEAD proposals, this includes an integrity algorithm, an
 483         encryption algorithm, an optional Diffie-Hellman group and an optional
 484         Extended Sequence Number Mode indicator. For AEAD proposals, a combined
 485         mode algorithm is used instead of the separate encryption/integrity
 486         algorithms.
 487
 488         If a DH group is specified, CHILD_SA/Quick Mode rekeying and initial (non
 489         IKE_AUTH piggybacked) negotiation uses a separate Diffie-Hellman exchange
 490         using the specified group. Extended Sequence Number support may be indicated
 491         with the _esn_ and _noesn_ values, both may be included to indicate support
 492         for both modes. If omitted, _noesn_ is assumed.
 493
 494         In IKEv2, multiple algorithms of the same kind can be specified in a single
 495         proposal, from which one gets selected. In IKEv1, only one algorithm per
 496         kind is allowed per proposal, more algorithms get implicitly stripped. Use
 497         multiple proposals to offer different algorithms combinations in IKEv1.
 498
 499         Algorithm keywords get separated using dashes. Multiple proposals may be
 500         separated by commas. The special value _default_ forms a default proposal
 501         of supported algorithms considered safe, and is usually a good choice
 502         for interoperability. If no algorithms are specified for AH nor ESP,
 503         the _default_ set of algorithms for ESP is included.
 504
 505 connections.<conn>.children.<child>.local_ts = dynamic
 506         Local traffic selectors to include in CHILD_SA.
 507
 508         Comma separated list of local traffic selectors to include in CHILD_SA.
 509         Each selector is a CIDR subnet definition, followed by an optional
 510         proto/port selector. The special value _dynamic_ may be used instead of a
 511         subnet definition, which gets replaced by the tunnel outer address or the
 512         virtual IP, if negotiated. This is the default.
 513
 514         A protocol/port selector is surrounded by opening and closing square
 515         brackets. Between these brackets, a numeric or **getservent**(3) protocol
 516         name may be specified. After the optional protocol restriction, an optional
 517         port restriction may be specified, separated by a slash. The port
 518         restriction may be numeric, a **getservent**(3) service name, or the special
 519         value _opaque_ for RFC 4301 OPAQUE selectors. Port ranges may be specified
 520         as well, none of the kernel backends currently support port ranges, though.
 521
 522         Unless the Unity extension is used, IKEv1 supports the first specified
 523         selector only. IKEv1 uses very similar traffic selector narrowing as it is
 524         supported in the IKEv2 protocol.
 525
 526 connections.<conn>.children.<child>.remote_ts = dynamic
 527         Remote selectors to include in CHILD_SA.
 528
 529         Comma separated list of remote selectors to include in CHILD_SA. See
 530         **local_ts** for a description of the selector syntax.
 531
 532 connections.<conn>.children.<child>.rekey_time = 1h
 533         Time to schedule CHILD_SA rekeying.
 534
 535         Time to schedule CHILD_SA rekeying. CHILD_SA rekeying refreshes key
 536         material, optionally using a Diffie-Hellman exchange if a group is
 537         specified in the proposal.
 538
 539         To avoid rekey collisions initiated by both ends simultaneously, a value
 540         in the range of **rand_time** gets subtracted to form the effective soft
 541         lifetime.
 542
 543         By default CHILD_SA rekeying is scheduled every hour, minus **rand_time**.
 544
 545 connections.<conn>.children.<child>.life_time = rekey_time + 10%
 546         Maximum lifetime before CHILD_SA gets closed, as time.
 547
 548         Maximum lifetime before CHILD_SA gets closed. Usually this hard lifetime
 549         is never reached, because the CHILD_SA gets rekeyed before.
 550         If that fails for whatever reason, this limit closes the CHILD_SA.
 551
 552         The default is 10% more than the **rekey_time**.
 553
 554 connections.<conn>.children.<child>.rand_time = life_time - rekey_time
 555         Range of random time to subtract from **rekey_time**.
 556
 557         Time range from which to choose a random value to subtract from
 558         **rekey_time**. The default is the difference between **life_time** and
 559         **rekey_time**.
 560
 561 connections.<conn>.children.<child>.rekey_bytes = 0
 562         Number of bytes processed before initiating CHILD_SA rekeying.
 563
 564         Number of bytes processed before initiating CHILD_SA rekeying. CHILD_SA
 565         rekeying refreshes key material, optionally using a Diffie-Hellman exchange
 566         if a group is specified in the proposal.
 567
 568         To avoid rekey collisions initiated by both ends simultaneously, a value
 569         in the range of **rand_bytes** gets subtracted to form the effective soft
 570         volume limit.
 571
 572         Volume based CHILD_SA rekeying is disabled by default.
 573
 574 connections.<conn>.children.<child>.life_bytes = rekey_bytes + 10%
 575         Maximum bytes processed before CHILD_SA gets closed.
 576
 577         Maximum bytes processed before CHILD_SA gets closed. Usually this hard
 578         volume limit is never reached, because the CHILD_SA gets rekeyed before.
 579         If that fails for whatever reason, this limit closes the CHILD_SA.
 580
 581         The default is 10% more than **rekey_bytes**.
 582
 583 connections.<conn>.children.<child>.rand_bytes = life_bytes - rekey_bytes
 584         Range of random bytes to subtract from **rekey_bytes**.
 585
 586         Byte range from which to choose a random value to subtract from
 587         **rekey_bytes**. The default is the difference between **life_bytes** and
 588         **rekey_bytes**.
 589
 590 connections.<conn>.children.<child>.rekey_packets = 0
 591         Number of packets processed before initiating CHILD_SA rekeying.
 592
 593         Number of packets processed before initiating CHILD_SA rekeying. CHILD_SA
 594         rekeying refreshes key material, optionally using a Diffie-Hellman exchange
 595         if a group is specified in the proposal.
 596
 597         To avoid rekey collisions initiated by both ends simultaneously, a value
 598         in the range of **rand_packets** gets subtracted to form the effective soft
 599         packet count limit.
 600
 601         Packet count based CHILD_SA rekeying is disabled by default.
 602
 603 connections.<conn>.children.<child>.life_packets = rekey_packets + 10%
 604         Maximum number of packets processed before CHILD_SA gets closed.
 605
 606         Maximum number of packets processed before CHILD_SA gets closed. Usually
 607         this hard packets limit is never reached, because the CHILD_SA gets rekeyed
 608         before. If that fails for whatever reason, this limit closes the CHILD_SA.
 609
 610         The default is 10% more than **rekey_bytes**.
 611
 612 connections.<conn>.children.<child>.rand_packets = life_packets - rekey_packets
 613         Range of random packets to subtract from **packets_bytes**.
 614
 615         Packet range from which to choose a random value to subtract from
 616         **rekey_packets**. The default is the difference between **life_packets**
 617         and **rekey_packets**.
 618
 619 connections.<conn>.children.<child>.updown =
 620         Updown script to invoke on CHILD_SA up and down events.
 621
 622 connections.<conn>.children.<child>.hostaccess = yes
 623         Hostaccess variable to pass to **updown** script.
 624
 625 connections.<conn>.children.<child>.mode = tunnel
 626         IPsec Mode to establish (_tunnel_, _transport_, _beet_, _pass_ or _drop_).
 627
 628         IPsec Mode to establish CHILD_SA with. _tunnel_ negotiates the CHILD_SA
 629         in IPsec Tunnel Mode, whereas _transport_ uses IPsec Transport Mode. _beet_
 630         is the Bound End to End Tunnel mixture mode, working with fixed inner
 631         addresses without the need to include them in each packet.
 632
 633         Both _transport_ and _beet_ modes are subject to mode negotiation; _tunnel_
 634         mode is negotiated if the preferred mode is not available.
 635
 636         _pass_ and _drop_ are used to install shunt policies which explicitly
 637         bypass the defined traffic from IPsec processing or drop it, respectively.
 638
 639 connections.<conn>.children.<child>.policies = yes
 640         Whether to install IPsec policies or not.
 641
 642         Whether to install IPsec policies or not. Disabling this can be useful in
 643         some scenarios e.g. MIPv6, where policies are not managed by the IKE daemon.
 644
 645 connections.<conn>.children.<child>.dpd_action = clear
 646         Action to perform on DPD timeout (_clear_, _trap_ or _restart_).
 647
 648         Action to perform for this CHILD_SA on DPD timeout. The default _clear_
 649         closes the CHILD_SA and does not take further action. _trap_ installs
 650         a trap policy, which will catch matching traffic and tries to re-negotiate
 651         the tunnel on-demand. _restart_ immediately tries to re-negotiate the
 652         CHILD_SA under a fresh IKE_SA.
 653
 654 connections.<conn>.children.<child>.ipcomp = no
 655         Enable IPComp compression before encryption.
 656
 657         Enable IPComp compression before encryption. If enabled, IKE tries to
 658         negotiate IPComp compression to compress ESP payload data prior to
 659         encryption.
 660
 661 connections.<conn>.children.<child>.inactivity = 0s
 662         Timeout before closing CHILD_SA after inactivity.
 663
 664         Timeout before closing CHILD_SA after inactivity. If no traffic has
 665         been processed in either direction for the configured timeout, the CHILD_SA
 666         gets closed due to inactivity. The default value of _0_ disables inactivity
 667         checks.
 668
 669 connections.<conn>.children.<child>.reqid = 0
 670         Fixed reqid to use for this CHILD_SA.
 671
 672         Fixed reqid to use for this CHILD_SA. This might be helpful in some
 673         scenarios, but works only if each CHILD_SA configuration is instantiated
 674         not more than once. The default of _0_ uses dynamic reqids, allocated
 675         incrementally.
 676
 677 connections.<conn>.children.<child>.mark_in = 0/0x00000000
 678         Netfilter mark and mask for input traffic.
 679
 680         Netfilter mark and mask for input traffic. On Linux Netfilter may require
 681         marks on each packet to match an SA having that option set. This allows
 682         Netfilter rules to select specific tunnels for incoming traffic. The
 683         special value _%unique_ sets a unique mark on each CHILD_SA instance.
 684
 685         An additional mask may be appended to the mark, separated by _/_. The
 686         default mask if omitted is 0xffffffff.
 687
 688 connections.<conn>.children.<child>.mark_out = 0/0x00000000
 689         Netfilter mark and mask for output traffic.
 690
 691         Netfilter mark and mask for output traffic. On Linux Netfilter may require
 692         marks on each packet to match a policy having that option set. This allows
 693         Netfilter rules to select specific tunnels for outgoing traffic. The
 694         special value _%unique_ sets a unique mark on each CHILD_SA instance.
 695
 696         An additional mask may be appended to the mark, separated by _/_. The
 697         default mask if omitted is 0xffffffff.
 698
 699 connections.<conn>.children.<child>.tfc_padding = 0
 700         Traffic Flow Confidentiality padding.
 701
 702         Pads ESP packets with additional data to have a consistent ESP packet size
 703         for improved Traffic Flow Confidentiality. The padding defines the minimum
 704         size of all ESP packets sent.
 705
 706         The default value of 0 disables TFC padding, the special value _mtu_ adds
 707         TFC padding to create a packet size equal to the Path Maximum Transfer Unit.
 708
 709 connections.<conn>.children.<child>.replay_window = 32
 710         IPsec replay window to configure for this CHILD_SA.
 711
 712         IPsec replay window to configure for this CHILD_SA. Larger values than the
 713         default of 32 are supported using the Netlink backend only, a value of 0
 714         disables IPsec replay protection.
 715
 716 connections.<conn>.children.<child>.start_action = none
 717         Action to perform after loading the configuration (_none_, _trap_, _start_).
 718
 719         Action to perform after loading the configuration. The default of _none_
 720         loads the connection only, which then can be manually initiated or used as
 721         a responder configuration.
 722
 723         The value _trap_ installs a trap policy, which triggers the tunnel as soon
 724         as matching traffic has been detected. The value _start_ initiates
 725         the connection actively.
 726
 727         When unloading or replacing a CHILD_SA configuration having a
 728         **start_action** different from _none_, the inverse action is performed.
 729         Configurations with _start_ get closed, while such with _trap_ get
 730         uninstalled.
 731
 732 connections.<conn>.children.<child>.close_action = none
 733         Action to perform after a CHILD_SA gets closed (_none_, _trap_, _start_).
 734
 735         Action to perform after a CHILD_SA gets closed by the peer. The default of
 736         _none_ does not take any action, _trap_ installs a trap policy for the
 737         CHILD_SA. _start_ tries to re-create the CHILD_SA.
 738
 739         **close_action** does not provide any guarantee that the CHILD_SA is kept
 740         alive. It acts on explicit close messages only, but not on negotiation
 741         failures. Use trap policies to reliably re-create failed CHILD_SAs.
 742
 743 secrets { # }
 744         Section defining secrets for IKE/EAP/XAuth authentication and private
 745         key decryption.
 746
 747         Section defining secrets for IKE/EAP/XAuth authentication and private key
 748         decryption. The **secrets** section takes sub-sections having a specific
 749         prefix which defines the secret type.
 750
 751         It is not recommended to define any private key decryption passphrases,
 752         as then there is no real security benefit in having encrypted keys. Either
 753         store the key unencrypted or enter the keys manually when loading
 754         credentials.
 755
 756 secrets.eap<suffix> { # }
 757         EAP secret section for a specific secret.
 758
 759         EAP secret section for a specific secret. Each EAP secret is defined in
 760         a unique section having the _eap_ prefix. EAP secrets are used for XAuth
 761         authentication as well.
 762
 763 secrets.xauth<suffix> { # }
 764         XAuth secret section for a specific secret.
 765
 766         XAuth secret section for a specific secret. **xauth** is just an alias
 767         for **eap**, secrets under both section prefixes are used for both EAP and
 768         XAuth authentication.
 769
 770 secrets.eap<suffix>.secret =
 771         Value of the EAP/XAuth secret.
 772
 773         Value of the EAP/XAuth secret. It may either be an ASCII string, a hex
 774         encoded string if it has a _0x_ prefix or a Base64 encoded string if it
 775         has a _0s_ prefix in its value.
 776
 777 secrets.eap<suffix>.id<suffix> =
 778         Identity the EAP/XAuth secret belongs to.
 779
 780         Identity the EAP/XAuth secret belongs to. Multiple unique identities may
 781         be specified, each having an _id_ prefix, if a secret is shared between
 782         multiple users.
 783
 784 secrets.ike<suffix> { # }
 785         IKE preshared secret section for a specific secret.
 786
 787         IKE preshared secret section for a specific secret. Each IKE PSK is defined
 788         in a unique section having the _ike_ prefix.
 789
 790 secrets.ike<suffix>.secret =
 791         Value of the IKE preshared secret.
 792
 793         Value of the IKE preshared secret. It may either be an ASCII string,
 794         a hex encoded string if it has a _0x_ prefix or a Base64 encoded string if
 795         it has a _0s_ prefix in its value.
 796
 797 secrets.ike<suffix>.id<suffix> =
 798         IKE identity the IKE preshared secret belongs to.
 799
 800         IKE identity the IKE preshared secret belongs to. Multiple unique identities
 801         may be specified, each having an _id_ prefix, if a secret is shared between
 802         multiple peers.
 803
 804 secrets.rsa<suffix> { # }
 805         Private key decryption passphrase for a key in the _rsa_ folder.
 806
 807 secrets.rsa<suffix>.file =
 808         File name in the _rsa_ folder for which this passphrase should be used.
 809
 810 secrets.rsa<suffix>.secret
 811         Value of decryption passphrase for RSA key.
 812
 813 secrets.ecdsa<suffix> { # }
 814         Private key decryption passphrase for a key in the _ecdsa_ folder.
 815
 816 secrets.ecdsa<suffix>.file =
 817         File name in the _ecdsa_ folder for which this passphrase should be used.
 818
 819 secrets.ecdsa<suffix>.secret
 820         Value of decryption passphrase for ECDSA key.
 821
 822 secrets.pkcs8<suffix> { # }
 823         Private key decryption passphrase for a key in the _pkcs8_ folder.
 824
 825 secrets.pkcs8<suffix>.file =
 826         File name in the _pkcs8_ folder for which this passphrase should be used.
 827
 828 secrets.pkcs8<suffix>.secret
 829         Value of decryption passphrase for PKCS#8 key.
 830
 831 secrets.pkcs12<suffix> { # }
 832         PKCS#12 decryption passphrase for a container in the _pkcs12_ folder.
 833
 834 secrets.pkcs12<suffix>.file =
 835         File name in the _pkcs12_ folder for which this passphrase should be used.
 836
 837 secrets.pkcs12<suffix>.secret
 838         Value of decryption passphrase for PKCS#12 container.
 839
 840 pools { # }
 841         Section defining named pools.
 842
 843         Section defining named pools. Named pools may be referenced by connections
 844         with the **pools** option to assign virtual IPs and other configuration
 845         attributes.
 846
 847 pools.<name> { # }
 848         Section defining a single pool with a unique name.
 849
 850 pools.<name>.addrs =
 851         Addresses allocated in pool.
 852
 853         Subnet or range defining addresses allocated in pool. Accepts a single CIDR
 854         subnet defining the pool to allocate addresses from or an address range
 855         (<from>-<to>).  Pools must be unique and non-overlapping.
 856
 857 pools.<name>.<attr> =
 858         Comma separated list of additional attributes from type <attr>.
 859
 860         Comma separated list of additional attributes of type **<attr>**. The
 861         attribute type may be one of _dns_, _nbns_, _dhcp_, _netmask_, _server_,
 862         _subnet_, _split_include_ and _split_exclude_ to define addresses or CIDR
 863         subnets for the corresponding attribute types. Alternatively, **<attr>** can
 864         be a numerical identifier, for which string attribute values are accepted
 865         as well.
 866
 867 authorities { # }
 868         Section defining attributes of certification authorities.
 869
 870 authorities.<name> { # }
 871         Section defining a certification authority with a unique name.
 872
 873 authorities.<name>.cacert =
 874         CA certificate belonging to the certification authority.
 875
 876         The certificates may use a relative path from the **swanctl** _x509ca_
 877         directory or an absolute path.
 878
 879 authorities.<name>.crl_uris =
 880         Comma-separated list of CRL distribution points
 881
 882         Comma-separated list of CRL distribution points (ldap, http, or file URI)
 883
 884 authorities.<name>.ocsp_uris =
 885         Comma-separated list of OCSP URIs
 886
 887         Comma-separated list of OCSP URIs
 888
 889 authorities.<name>.cert_uri_base =
 890         Defines the base URI for the Hash and URL feature supported by IKEv2.
 891
 892         Defines the base URI for the Hash and URL feature supported by IKEv2.
 893         Instead of exchanging complete certificates, IKEv2 allows one to send an
 894         URI that resolves to the DER encoded certificate. The certificate URIs are
 895         built by appending the SHA1 hash of the DER encoded certificates to this
 896         base URI.
 897