ipsec-add - Man Page

ipsec add connection​.​.​. [--auto route | up | keep] [--bg[={yes,no}] | [--asynchronous[={yes,no}]]

ipsec add --autoall [--bg[={yes,no}] | [--asynchronous[={yes,no}]]

ipsec add --checkconfig

ipsec add ​.​.​. [--dry-run] [-n] [--verbose] [--config /etc/ipsec.conf] [--ctlsocket /run/pluto/pluto​.ctl]

ipsec ondemand connection​.​.​. [--bg[={yes,no}] | [--asynchronous[={yes,no}]]

The command ipsec add reads connection specifications from the configuration file /etc/ipsec.conf and then loads them into pluto:

ipsec add connection​.​.​.

The connection's specification is loaded into into pluto's internal connection database, and configured to accept connections from remote peers (see also --auto and --autoall)​. If a connection with same name already exists in pluto's connection database then the old connection's tunnels are torn down and the new connection specification replaces old one​.

The option --auto specifies additional action to take once the connection is loaded: --auto=up also initiates the connection (see ipsec-up(8)); --auto=route routes the connection (make it on-demand) (see ipsec-route(8))​.

This is equivalent to a connection with auto=add being loaded during startup​.

By default, once all connections are loaded, ipsec add connection​.​.​. will continue to monitor pluto's logs until additional actions, such as --auto=up, have completed (--asynchronous=no)​.

ipsec add --autoall

Load all connection specifications with auto=add, auto=route, auto=up, or auto=keep​. In addition, auto=route connections will be routed (made on-demand) and auto=up will be initiated​.

By default, once all connections are loaded, ipsec add --autoall will disconnect from pluto​. Additional actions, such as auto=up, will be performed in the background (--asynchronous=yes)​.

ipsec add --checkconfig

Parse the configuration file, performing minimal validation​. This will return 0 if config was valid​. Optionally you can add --verbose for more detailed analysis​.

ipsec ondemand connection​.​.​.

Load and then route (make on-demand) the connection​.

This is equivalent to a connection with auto=route being loaded during startup​.

Note: if the new connection uses pre-shared key (PSK) authentication the command ipsec rereadsecrets may also be needed as secrets keys are only only read at startup​.

To inspect a loaded connection run ipsec connectionstatus connection (see ipsec-connectionstatus(8)) and to remove it run ipsec delete connection (see ipsec-delete(8));​.

The following additional options are supported by all variants of ipsec add:

--dry-run

-n

Do not pass the connections to pluto​.

--verbose

Increase verbosity​.

--config config-file

Specify an alternative configuration file to load​.

The default is /etc/ipsec.conf​.

--ctlsocket socket-file

Specify an alternative control socket to use​.

The default is /run/pluto/pluto​.ctl​.

--asynchronous[={yes,no}

--bg[={yes,no}

Should ipsec add detach, allowing auto= to be performed in the background?

ipsec(8), ipsec.conf(5), ipsec-delete(8) ipsec-route(8), ipsec-up(8),

none

Andrew Cagney, Tuomo Soini

ipsec(8), ipsec-briefconnectionstatus(8), ipsec-briefstatus(8), ipsec-certutil(8), ipsec-checknflog(8), ipsec-checknss(8), ipsec-connectionstatus(8), ipsec-crlutil(8), ipsec-delete(8), ipsec-down(8), ipsec-fetchcrls(8), ipsec-fipsstatus(8), ipsec-globalstatus(8), ipsec-import(8), ipsec-initnss(8), ipsec-listall(8), ipsec-listcacerts(8), ipsec-listcerts(8), ipsec-listcrls(8), ipsec-listen(8), ipsec-listpubkeys(8), ipsec-modutil(8), ipsec-pk12util(8), ipsec-purgeocsp(8), ipsec-redirect(8), ipsec-replace(8), ipsec-rereadall(8), ipsec-rereadcerts(8), ipsec-rereadsecrets(8), ipsec-restart(8), ipsec-route(8), ipsec-showstates(8), ipsec-shuntstatus(8), ipsec-start(8), ipsec-status(8), ipsec-stop(8), ipsec-trafficstatus(8), ipsec-unroute(8), ipsec-up(8), ipsec-vfychain(8).

The man page ipsec-ondemand(8) is an alias of ipsec-add(8).