Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have multiple productive IPSec VPNs on a Debian-based Linux Server using StrongSwan. Currently I am busy updating my documentation with details about each VPN. Unfortunately the IKE encryption algorithm and hash algorithm is not set explicitly. I wonder if there is a way to find out for an active VPN which algorithms are currenlty used without re-establishing the VPN.

You can use the following command for VPNs where the algorithms are explicitly set:

ipsec statusall myVPNname | grep "IKE algo"

Example output:

IKE algorithm newest: 3DES_CBC_192-SHA-MODP1024

Unfortunately for the other VPNs, where the algorithms are not set explicitly the command mentioned above does not come up with the information.

Maybe someone of you guys knows how to find it out?



share|improve this question

what about:

ipsec statusall conn_name | grep 'IKE proposal'

works for me on IKEv1 road-warrior scenario. if not that line, try others, but I've never had problem finding any relevant information in "ipsec statusall" output.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.