Strongswan ipsec command

ipsec

• ipsec
  • Control Commands
  • Info Commands
  • List Commands
  • Reread Commands
  • Reset Commands
  • Purge Commands
  • Before 5.0.0
    • List Commands
    • PKCS11 Proxy Commands

ipsec is actually an umbrella command comprising a collection of individual sub commands of the form

ipsec <command> [ <argument> ] [ <options> ]

that can be used to control and monitor IPsec connections as well as the IKE daemons.

Control Commands

ipsec start [ <starter options> ]

calls ipsec starter [ <starter options> ] which in turn parses ipsec.conf and starts the IKE daemon charon.

ipsec stop

terminates all IPsec connection and stops the IKE daemon charon by sending a TERM signal to ipsec starter.

ipsec restart [ <starter options> ]

is equivalent to ipsec stop followed by ipsec start [ <starter options> ] after a guard period of 2 seconds.

ipsec update

sends a HUP signal to ipsec starter which in turn determines any changes in ipsec.conf and updates the configuration on the running IKE daemon charon. Currently established connections are not affected by configuration changes.

ipsec reload

sends a USR1 signal to ipsec starter which in turn reloads the whole configuration on the running IKE daemon charon based on the actual ipsec.conf. Currently established connections are not affected by configuration changes.

ipsec up <name>

tells the IKE daemon to start up connection <name>. Implemented by calling the ipsec stroke up <name> command.

ipsec down <name>

tells the IKE daemon to terminate connection <name>. Implemented by calling the ipsec stroke down <name> command.

ipsec down <name>{n}

terminates CHILD_SA instance n of connection <name>. Since {n} uniquely identifis a CHILD_SA the name is optional.

ipsec down <name>{*}

terminates all CHILD_SA instances of connection <name>.

ipsec down <name>[n]

terminates IKE_SA instance n of connection <name> plus dependent CHILD_SAs. Since [n] uniquely identifis an IKE_SA the name is optional.

ipsec down <name>[*]

terminates all IKE_SA instances of connection <name>.

ipsec route <name>

tells the IKE daemon to insert IPsec policies in the kernel for connection <name>. The first payload packet matching the IPsec policies will automatically trigger an IKE connection setup. Implemented by calling the ipsec stroke route <name> command.

ipsec unroute <name>

remove the IPsec policies in the kernel for connection <name>. Implemented by calling the ipsec stroke unroute <name>command.

ipsec status [ <name> ]

returns concise status information either on connection <name> or if the argument is lacking, on all connections. Implemented by calling the ipsec stroke status [ <name> ] command.

ipsec statusall [ <name> ]

returns detailed status information either on connection <name> or if the argument is lacking, on all connections. Implemented by calling the ipsec stroke statusall [ <name> ] command.

Info Commands

ipsec version

returns the ipsec version in the form of Linux strongSwan U<strongSwan userland version>/K<Linux kernel version> if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is running on.

ipsec copyright

returns the copyright information.

ipsec --confdir

returns the SYSCONFDIR directory as defined by the configure options.

ipsec --directory

returns the LIBEXECDIR directory as defined by the configure options.

ipsec --help

returns the usage information for the ipsec command.

ipsec --versioncode

returns the ipsec version number in the form of U<strongSwan userland version>/K<Linux kernel version> if strongSwan uses the native NETKEY IPsec stack of the Linux kernel it is running on.

List Commands

ipsec listaacerts [ --utc ]

returns a list of X.509 Authorization Authority (AA) certificates that were loaded locally by the IKE daemon from the/etc/ipsec.d/aacerts directory. Implemented by calling the ipsec stroke listaacerts command.

ipsec listacerts [ --utc ]

returns a list of X.509 Attribute certificates that were loaded locally by the IKE daemon from the /etc/ipsec.d/acerts directory. Implemented by calling the ipsec stroke listacerts command.

ipsec listcounters [ <name> ]

returns a list of global or connection specific counter values about received and sent IKE messages and rekeyings. Connection specific ounters are available since 5.0.3. Implemented by calling the ipsec stroke listcounters command.

ipsec listalgs

returns a list of all supported IKE encryption and hash algorithms, and the available Diffie-Hellman groups. Implemented by calling theipsec stroke listalgs command.

ipsec listcacerts [ --utc ]

returns a list of X.509 Certification Authority (CA) certificates that were loaded locally by the IKE daemon from the/etc/ipsec.d/cacerts directory or received via the IKE protocol. Implemented by calling the ipsec stroke listcacerts command.

ipsec listcainfos [ --utc ]

returns Certification Authority information (CRL distribution points, OCSP URIs, LDAP servers) that were defined by ca sections inipsec.conf. Implemented by calling the ipsec stroke listcainfos command.

ipsec listcrls [ --utc ]

returns a list of Certificate Revocation Lists (CRLs) that were either loaded by the IKE daemon from the /etc/ipsec.d/crls directory or fetched from an HTTP- or LDAP-based CRL distribution point. Implemented by calling the ipsec stroke listcrls command.

ipsec listcerts [ --utc ]

returns a list of X.509 and/or OpenPGP certificates that were either loaded locally by the IKE daemon or received via the IKE protocol. Implemented by calling the ipsec stroke listcerts command.

ipsec listgroups [ --utc ]

returns a list of all groups that are used to define user authorization profiles. Currently not supported.

ipsec listocsp [ --utc ]

returns cached revocation information fetched from OCSP servers. Implemented by calling the ipsec stroke listocsp command.

ipsec listocspcerts [ --utc ]

returns a list of X.509 OCSP Signer certificates that were either loaded locally by the IKE daemon from the /etc/ipsec.d/ocspcertsdirectory or were sent by an OCSP server. Implemented by calling the ipsec stroke listocspcerts command.

ipsec listplugins

returns a list of all loaded plugin features. Implemented by calling the ipsec stroke listplugins command.

ipsec listpubkeys [ --utc ]

returns a list of RSA public keys that were loaded in raw key format. Implemented by calling the ipsec stroke listpubkeys command.

ipsec listall [ --utc ]

returns all information generated by the list commands above. Each list command can be called with the --utc option which displays all dates in UTC instead of local time. Implemented by calling the ipsec stroke listall command.

Reread Commands

ipsec rereadaacerts

reads all certificate files contained in the /etc/ipsec.d/aacerts directory and adds them to the list of Authorization Authority (AA) certificates. Implemented by calling the ipsec stroke rereadaacerts command.

ipsec rereadacerts

reads all certificate files contained in the /etc/ipsec.d/acerts directory and adds them to the list of attribute certificates. Implemented by calling the ipsec stroke rereadacerts command.

ipsec rereadcacerts

reads all certificate files contained in the /etc/ipsec.d/cacerts directory and adds them to the list of Certification Authority (CA) certificates. Implemented by calling the ipsec stroke rereadcacerts command.

ipsec rereadcrls

reads all Certificate Revocation Lists (CRLs) contained in the /etc/ipsec.d/crls directory and adds them to the list of CRLs. Older CRLs are replaced by newer ones. Implemented by calling the ipsec stroke rereadcrls command.

ipsec rereadocspcerts

reads all certificate files contained in the /etc/ipsec.d/ocspcerts directory and adds them to the list of OCSP signer certificates. Implemented by calling the ipsec stroke rereadocspcerts command.

ipsec rereadsecrets

flushes and rereads all secrets defined in ipsec.secrets. Implemented by calling the ipsec stroke rereadsecrets command.

ipsec secrets

is equivalent to ipsec rereadsecrets.

ipsec rereadall

executes all reread commands listed above. Implemented by calling the ipsec stroke rereadall command.

Reset Commands

ipsec resetcounters [ <name> ]

resets global or connection specific counters. Since 5.0.3. Implemented by calling the ipsec stroke resetcounters command.

Purge Commands

ipsec purgecerts

purges all cached certificates. Implemented by calling the ipsec stroke purgecerts command.

ipsec purgecrl

purges all cached CRLs. Implemented by calling the ipsec stroke purgecrl command.

ipsec purgeike

purges IKE_SAs that don't have a CHILD_SA. Implemented by calling the ipsec stroke purgeike command.

ipsec purgeocsp

purges all cached OCSP information records. Implemented by calling the ipsec stroke purgeocsp command.

Before 5.0.0

In releases before 5.0.0 IKEv1 connections were handled by the separate pluto keying daemon. The ipsec command then used theipsec whack in addition to the ipsec stroke command to communicate with pluto.

List Commands

ipsec listcards [ --utc ]

lists all certificates found on attached smart cards. Supported by the IKEv1 pluto daemon only. Implemented by calling the ipsec whack --listcards command.

PKCS11 Proxy Commands

ipsec scencrypt <value> [ --inbase <base> ] [ --outbase <base> ] [ --keyid <id> ]

Supported by the IKEv1 pluto daemon only. Implemented by calling the ipsec whack --scencrypt command.

ipsec scdecrypt <value> [ --inbase <base> ] [ --outbase <base> ] [ --keyid <id> ]

Supported by the IKEv1 pluto daemon only. Implemented by calling the ipsec whack --scdecrypt command.