Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am having trouble configuring a connection to an Android device using a fedora 17 linux machine and strongSwanv5.0.1dr2. I have made some progress but when I try adding the configuration to support xauth authentication I receive an error when I try to reload the configuration file. I get a similar error for the value ikev1 for the keyexchange setting , and whenever i try to set a value for rightauth. Has anyone else had this problem The man page for ipsec.conf and the documentation on the strongswan wiki both indicated that these settings and values should be fine in 5.0.x.x. I could try setting authby but that is deprecated according to the documentation i read and the xauthpsk value isn't working. Any help is much appreciated thanks.

can not load config '/etc/ipsec.conf': /etc/ipsec.conf:25: syntax error, unexpected STRING [leftauth]

# /etc/ipsec.conf - Openswan IPsec configuration file
# Manual:     ipsec.conf.5
# Please place your own config files in /etc/ipsec.d/ ending in .conf

version 2.0     # conforms to second version of ipsec.conf specification

# basic configuration
config setup
       # For Red Hat Enterprise Linux and Fedora, leave protostack=netkey
        # Enable this if you see "failed to find any available worker"
        # nhelpers=0
conn %default

conn android
#You may put your configuration (.conf) file in the "/etc/ipsec.d/"
#include /etc/ipsec.d/*.conf
share|improve this question
up vote 4 down vote accepted

To configure XAuth PSK with strongSwan 5.0.x (as responder) you have to use:


While deprecated authby=xauthpsk would actually still work as an alias for the above (with xauth=server also added).

can not load config '/etc/ipsec.conf': /etc/ipsec.conf:25: syntax error, unexpected STRING [leftauth]

This error and the fact that several options used here are no valid strongSwan options (e.g. phase2 and leftxauthserver, the semicolon in the value for ike is also invalid) lead me to believe that you actually don't use strongSwan but Openswan instead (leftauth is an invalid option there).

As you probably built the developer release directly from the tarball the reason could be that you did not provide the proper ./configure options (e.g. --prefix and --sysconfdir) to replace the ipsec script provided by the default Fedora Openswan package. To avoid conflict you might want to remove that package anyway, if not, you could also use the --with-ipsec-script=strongswan option to rename strongSwan's ipsec script to strongswan.

share|improve this answer
Thanks for the help. I removed the default Openswan package and now things are working and making much more sense – dudebrobro Sep 13 '12 at 14:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.