IPSEC-ADDCONN(8)

NAME
ipsec-addconn - load a given policy into the pluto IKE daemon

SYNOPSIS

ipsec addconn [--config /etc/ipsec.conf] [--ctlsocket /run/pluto/pluto.ctl] [--verbose] [--debug] --options...

ipsec addconn connection...

ipsec addconn --configsetup [=option] [--noexport]

ipsec addconn --liststack [--noexport]

ipsec addconn --checkconfig

ipsec addconn --autoall

ipsec addconn --listadd | --listall | --listignore | --listroute | --liststart

ipsec addconn --name connection-name [left=address] [right=address] option=value...

ipsec addconn --help

DESCRIPTION

ipsec addconn takes a config file (or stdin) containing the format of ipsec.conf, or the format of individual "conn" sections, and uses that information to load named or all connections defined in that configuration file into the running libreswan pluto IKE daemon. If no configuration file is specified, the default configuration file is used. If no pluto socket is specified, the default socket location will be used.

When --autoall is specified, all connections that include the auto= configuration option are processed as follows:

auto=add, auto=keep
    the connection is loaded

auto=route, auto=ondemand
    the connection is loaded and routed

auto=up, auto=start
    the connection is loaded, routed, marked as needing to stay up, and initiated

If the connection is already loaded then it is first removed.

When one or more connections are specified, those connections are loaded. Any auto= in the configuration is ignored.

When --configsetup is specified, the configuration file is parsed for the config setup section and printed to the terminal in a form usable as a shell script. These are prefaced with export unless --noexport is specified. When an option is specified, just the value of that option is printed.

When --checkconfig is specified, the configuration file is parsed and all sections are checked for correct syntax. If an error is found, information about it is printed to the terminal.

When --listroute or --liststart is specified, no connections are added or replaced, only shown. This command can be used to verify which connections the addcon command would act upon, without actually performing any action.

When --name connection is specified, addconn constructs a connection description by parsing the remainder of the command line as ipsec.conf(5) conn section key-values. The resulting connection is then loaded into pluto.

SEE ALSO

ipsec.conf(5), ipsec(8), libreswan(7)

HISTORY

Man page written for the Libreswan project <https://libreswan.org/> by Paul Wouters

AUTHOR

Paul Wouters