swanctl: Document how connections.*.unique affects initiators

diff --git a/src/swanctl/swanctl.opt b/src/swanctl/swanctl.opt
index 5e38a6673fa07ff04b471ec2b211ff09bf35dd7d..f1e47a9e4bd950217b1834cd3ab90c6daaa7b5da 100644 (file)
--- a/src/swanctl/swanctl.opt
+++ b/src/swanctl/swanctl.opt
@@ -194,6 +194,11 @@ connections.<conn>.unique = no
        EAP or XAuth authentication is involved, the EAP-Identity or XAuth username
        is used to enforce the uniqueness policy instead.
 
+       On initiators this setting specifies whether an INITIAL_CONTACT notify is
+       sent during IKE_AUTH if no existing connection is found with the remote
+       peer (determined by the identities of the first authentication round).
+       Only if set to _keep_ or _replace_ will the client send a notify.
+
 connections.<conn>.reauth_time = 0s
        Time to schedule IKE reauthentication.