Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

The docs on this are pretty vague,

what operation, if any, should be done automatically at IPsec startup. add loads a connection without starting it. route loads a connection and installs kernel traps. If traffic is detected between leftsubnet and rightsubnet, a connection is established. start loads a connection and brings it up immediately. ignore ignores the connection. This is equal to deleting a connection from the config file. Relevant only locally, other end need not agree on it.

What does it mean to load a connection without starting it vs bringing it up immediately? Can anyone provide a simple example?

share|improve this question

2 Answers 2

The introduction document on the strongSwan wiki has some more information about this. The three options to start connections are as follows:

  • Manually (or by remote peers): Connections with auto=add are loaded but nothing happens automatically afterwards. They can then be initiated manually using ipsec up <name> (provided a single hostname/IP is configured in right).

    Such connections also allow remote peers to initiate a connection, given their IP matches whatever is configured in right (so you'll often see connections with right=%any in remote access scenarios, where the clients' IP addresses are generally unknown).

  • Automatically: With auto=start a connection is loaded and the IKE daemon will immediately start to connect to the remote host configured in right. This is basically like manually calling ipsec up for these connections directly after the IKE daemon got started.

  • On demand: The IKE daemon will load connections with auto=route and install trap policies, based on the traffic selectors configured with left|rightsubnet, in the underlying IPsec implementation, for instance, the Linux kernel. When the kernel later encounters traffic that matches these policies it will request the IKE daemon to initiate the connection.

    Such connections can also be initiated manually using ipsec up.

    Furthermore it is possible to remove the policies installed in the kernel later on using ipsec unroute. The connection then has the same status as one that got added with auto=add. Likewise, connections that were loaded with auto=add (or auto=start) can be routed using ipsec route.

share|improve this answer

auto=add will add the connection in a listening state - ready for the remote end to initiate a connection.

auto=start will add the connection and attempt to initiate a connection to the remote.

So generally, you want one peer (left or right) to auto=add and the other end to auto=start

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.