IPSEC-ADD(8) Executable programs IPSEC-ADD(8)

.SH "NAME" ipsec-add, ipsec-ondemand - Add a connection specification to pluto internal database from /etc/ipsec.conf

.SH "SYNOPSIS"

.HP 576u

**ipsec add connection...**  
[ | --auto | route | up | keep  
]  
\[--bg\[={yes,no}] | \[--asynchronous\[={yes,no}]]

.HP 480u

**ipsec add --autoall**  
\[--bg\[={yes,no}] | \[--asynchronous\[={yes,no}]]

.HP 576u

**ipsec add --checkconfig**

.HP 336u

**ipsec add ...**  
\[--dry-run]  
\[-n]  
\[--verbose]  
\[--config */etc/ipsec.conf*]  
\[--ctlsocket */run/pluto/pluto.ctl*]

.HP 696u

**ipsec ondemand connection...**  
\[--bg\[={yes,no}] | \[--asynchronous\[={yes,no}]]

.SH "DESCRIPTION"

.PP The command **ipsec add** reads connection specifications from the configuration file /etc/ipsec.conf and then loads them into **pluto**:

.PP **ipsec add connection...**

The *connection's* specification is loaded into into **pluto**'s internal connection database, and configured to accept connections from remote peers (see also **--auto** and **--autoall**). If a connection with same name already exists in **pluto**'s connection database then the old connection's tunnels are torn down and the new connection specification replaces old one.

The option **--auto** specifies additional action to take once the connection is loaded: **--auto=up** also initiates the connection (see [**ipsec-up**(8)](/man/enterprise-packages/libreswan/ipsec-up.8)); **--auto=route** routes the connection (make it on-demand) (see [**ipsec-route**(8)](/man/enterprise-packages/libreswan/ipsec-route.8)).

This is equivalent to a connection with **auto=add** being loaded during startup.

By default, once all connections are loaded, **ipsec add connection...** will continue to monitor **pluto**'s logs until additional actions, such as **--auto=up**, have completed (**--asynchronous=no**).

.RE

.PP **ipsec add --autoall**

Load all connection specifications with **auto=add**, **auto=route**, **auto=up**, or **auto=keep**. In addition, **auto=route** connections will be routed (made on-demand) and **auto=up** will be initiated.

By default, once all connections are loaded, **ipsec add --autoall** will disconnect from **pluto**. Additional actions, such as **auto=up**, will be performed in the background (**--asynchronous=yes**).

.RE

.PP **ipsec add --checkconfig**

Parse the configuration file, performing minimal validation. This will return 0 if config was valid. Optionally you can add **--verbose** for more detailed analysis.

.RE

.PP **ipsec ondemand connection...**

Load and then route (make on-demand) the *connection*.

This is equivalent to a connection with **auto=route** being loaded during startup.

.RE

.PP Note: if the new connection uses pre-shared key (PSK) authentication the command **ipsec rereadsecrets** may also be needed as secrets keys are only only read at startup.

.PP To inspect a loaded connection run **ipsec connectionstatus connection** (see [**ipsec-connectionstatus**(8)](/man/enterprise-packages/libreswan/ipsec-connectionstatus.8)) and to remove it run **ipsec delete connection** (see [**ipsec-delete**(8)](/man/enterprise-packages/libreswan/ipsec-delete.8));.

.PP The following additional options are supported by all variants of **ipsec add**:

.PP **--dry-run**  
**-n**

Do not pass the connections to **pluto**.

.RE

.PP **--verbose**

Increase verbosity.

.RE

.PP **--config config-file**

Specify an alternative configuration file to load.

The default is /etc/ipsec.conf.

.RE

.PP **--ctlsocket socket-file**

Specify an alternative control socket to use.

The default is /run/pluto/pluto.ctl.

.RE

.PP **--asynchronous[={yes,no}**  
**--bg[={yes,no}**

Should **ipsec add** detach, allowing **auto=** to be performed in the background?

.RE

.SH "SEE ALSO"

.PP [**ipsec**(8)](/man/enterprise-packages/libreswan/ipsec.8), [**ipsec.conf**(5)](/man/enterprise-packages/libreswan/ipsec.conf.5), [**ipsec-delete**(8)](/man/enterprise-packages/libreswan/ipsec-delete.8) [**ipsec-route**(8)](/man/enterprise-packages/libreswan/ipsec-route.8), [**ipsec-up**(8)](/man/enterprise-packages/libreswan/ipsec-up.8),

.SH "BUGS"

.PP none

.SH "AUTHOR"

Andrew Cagney, Tuomo Soini

10/06/2026 Libreswan v5.4.1-HEAD

---

Document: ipsec-add(8) from libreswan 5.4.1-r0 (Chainguard OS)
Source: https://github.com/libreswan/libreswan