IPSEC-ALGPARSE(8) Executable programs IPSEC-ALGPARSE(8)

.SH "NAME" ipsec-algparse - utility for verifying IKE and IPsec cryptographic proposal syntax

.SH "SYNOPSIS"

.HP 360u

**ipsec algparse**  
\[--verbose]  
\[--debug]  
\[--nssdir *directory*] \[--nsspw *password*] \[--seeddev *device*] \[--seedbits *bits*]

[ | --ikev1 | --ikev2 | --verbose | --pfs { | yes | no } | --fips { | yes | no } | --ignore | --impair  
]

{ | --tp | --ta | ike=*proposals* | esp=*proposals* | ah=*proposals* | *proposals*  
}

.SH "DESCRIPTION"

.PP **ipsec algparse** is a utility that parses and expands and Internet Key Exchange cryptographic proposals using the same syntax as used in the file ipsec.conf (see the description of **ike=** and **esp=** in ipsec.conf (see [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5) for details). In addition, **ipsec algparse** can be used to run the proposal parser or the cryptographic algorithm testsuites.

.PP The following options control what **ipsec algparse** will parse:

.PP **ike=\[proposals**]  
**esp=\[proposals**]  
**ah=\[proposals**]

Parse the *proposals* using the IKE, ESP, or AH proposal parser. When *proposals* is omitted, display the default IKE, ESP, or AH proposals.

.RE

.PP **proposal**

Try to parse the proposal using all three of the IKE, ESP, and AH proposal parsers.

.RE

.PP **-tp**

run the proposal testsuite

.RE

.PP **-ta**

run the algorithm testsuite

.RE

.PP The following options alter the parser behaviour:

.PP **-v1**  
**-v2**

Parse the *proposals* using either the IKEv1 or IKEv2 proposal syntax.

The default is IKEv2.

.RE

.PP **-pfs=yes|no**

Specify PFS (Perfect Forward Privicy). When **yes** Diffi-Helman algorithms will be included in the proposal.

The default is **--pfs=no**.

.RE

.PP **-fips=yes|no**

Force NSS into FIPS mode.

The default is determined by the system environment.

.RE

.PP **-p1**  
**-p2**

Specify the parser to use.

By default, IKEv1 uses the simple (p1) parser, and IKEv2 uses the more complex (p2) parser.

.RE

.PP **-nsspw**

Specify the NSS database password.

.RE

.PP **-impair**

Impair the parser, disabling all algorithm checks.

.RE

.PP **-ignore**

Ignore parser errors.

.RE

.PP **-v**  
**-verbose**

Be more verbose when invoking proposal parser.

.RE

.PP **-d**  
**-debug**

Enable full debug-logging when invoking the proposal parser.

.RE

.SH "HISTORY"

.PP Written for the Libreswan project by Andrew Cagney.

.SH "AUTHOR"

Andrew Cagney, Tuomo Soini

08/30/2026 Libreswan v5.4-HEAD

---

Document: ipsec-algparse(8) from libreswan 5.4-r2 (Chainguard OS)
Source: https://github.com/libreswan/libreswan