'\" t .\" Title: IPSEC-ADD .\" Author: [see the "AUTHOR" section] .\" Generator: DocBook XSL Stylesheets v1.79.2 .\" Date: 10/06/2026 .\" Manual: Executable programs .\" Source: Libreswan v5.4.1-HEAD .\" Language: English .\" .TH "IPSEC\-ADD" "8" "10/06/2026" "Libreswan v5.4.1-HEAD" "Executable programs" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\" http://bugs.debian.org/507673 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" ----------------------------------------------------------------- .\" * set default formatting .\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .\" ----------------------------------------------------------------- .\" * MAIN CONTENT STARTS HERE * .\" ----------------------------------------------------------------- .SH "NAME" ipsec-add, ipsec-ondemand \- Add a connection specification to pluto internal database from /etc/ipsec.conf .SH "SYNOPSIS" .HP \w'\fBipsec\ add\ \fR\fB\fIconnection\fR\fR\fB\&.\&.\&.\fR\ 'u \fBipsec add \fR\fB\fIconnection\fR\fR\fB\&.\&.\&.\fR [ | \-\-auto\ |\ route\ |\ up\ |\ keep ] [\-\-bg[={yes,no}] | [\-\-asynchronous[={yes,no}]] .HP \w'\fBipsec\ add\ \-\-autoall\fR\ 'u \fBipsec add \-\-autoall\fR [\-\-bg[={yes,no}] | [\-\-asynchronous[={yes,no}]] .HP \w'\fBipsec\ add\ \-\-checkconfig\fR\ 'u \fBipsec add \-\-checkconfig\fR .HP \w'\fBipsec\ add\ \&.\&.\&.\fR\ 'u \fBipsec add \&.\&.\&.\fR [\-\-dry\-run] [\-n] [\-\-verbose] [\-\-config\ \fI/etc/ipsec.conf\fR] [\-\-ctlsocket\ \fI/run/pluto/pluto\&.ctl\fR] .HP \w'\fBipsec\ ondemand\ \fR\fB\fIconnection\fR\fR\fB\&.\&.\&.\fR\ 'u \fBipsec ondemand \fR\fB\fIconnection\fR\fR\fB\&.\&.\&.\fR [\-\-bg[={yes,no}] | [\-\-asynchronous[={yes,no}]] .SH "DESCRIPTION" .PP The command \fBipsec add\fR reads connection specifications from the configuration file /etc/ipsec.conf and then loads them into \fBpluto\fR: .PP \fB ipsec add \fR\fB\fIconnection\fR\fR\fB\&.\&.\&. \fR .RS 4 The \fIconnection\*(Aqs\fR specification is loaded into into \fBpluto\fR\*(Aqs internal connection database, and configured to accept connections from remote peers (see also \fB\-\-auto\fR and \fB\-\-autoall\fR)\&. If a connection with same name already exists in \fBpluto\fR\*(Aqs connection database then the old connection\*(Aqs tunnels are torn down and the new connection specification replaces old one\&. .sp The option \fB\-\-auto\fR specifies additional action to take once the connection is loaded: \fB\-\-auto=up\fR also initiates the connection (see \fBipsec-up\fR(8)); \fB\-\-auto=route\fR routes the connection (make it on\-demand) (see \fBipsec-route\fR(8))\&. .sp This is equivalent to a connection with \fBauto=add\fR being loaded during startup\&. .sp By default, once all connections are loaded, \fBipsec add \fR\fB\fIconnection\fR\fR\fB\&.\&.\&.\fR will continue to monitor \fBpluto\fR\*(Aqs logs until additional actions, such as \fB\-\-auto=up\fR, have completed (\fB\-\-asynchronous=no\fR)\&. .RE .PP \fB ipsec add \-\-autoall \fR .RS 4 Load all connection specifications with \fBauto=add\fR, \fBauto=route\fR, \fBauto=up\fR, or \fBauto=keep\fR\&. In addition, \fBauto=route\fR connections will be routed (made on\-demand) and \fBauto=up\fR will be initiated\&. .sp By default, once all connections are loaded, \fBipsec add \-\-autoall\fR will disconnect from \fBpluto\fR\&. Additional actions, such as \fBauto=up\fR, will be performed in the background (\fB\-\-asynchronous=yes\fR)\&. .RE .PP \fB ipsec add \-\-checkconfig \fR .RS 4 Parse the configuration file, performing minimal validation\&. This will return 0 if config was valid\&. Optionally you can add \fB\-\-verbose\fR for more detailed analysis\&. .RE .PP \fB ipsec ondemand \fR\fB\fIconnection\fR\fR\fB\&.\&.\&. \fR .RS 4 Load and then route (make on\-demand) the \fIconnection\fR\&. .sp This is equivalent to a connection with \fBauto=route\fR being loaded during startup\&. .RE .PP Note: if the new connection uses pre\-shared key (PSK) authentication the command \fBipsec rereadsecrets\fR may also be needed as secrets keys are only only read at startup\&. .PP To inspect a loaded connection run \fB ipsec connectionstatus \fR\fB\fIconnection\fR\fR\fB \fR (see \fBipsec-connectionstatus\fR(8)) and to remove it run \fB ipsec delete \fR\fB\fIconnection\fR\fR\fB \fR (see \fBipsec-delete\fR(8));\&. .PP The following additional options are supported by all variants of \fBipsec add\fR: .PP \fB\-\-dry\-run\fR .br \fB\-n\fR .RS 4 Do not pass the connections to \fBpluto\fR\&. .RE .PP \fB\-\-verbose\fR .RS 4 Increase verbosity\&. .RE .PP \fB\-\-config \fR\fB\fIconfig\-file\fR\fR .RS 4 Specify an alternative configuration file to load\&. .sp The default is /etc/ipsec.conf\&. .RE .PP \fB\-\-ctlsocket \fR\fB\fIsocket\-file\fR\fR .RS 4 Specify an alternative control socket to use\&. .sp The default is /run/pluto/pluto\&.ctl\&. .RE .PP \fB\-\-asynchronous[={yes,no}\fR .br \fB\-\-bg[={yes,no}\fR .RS 4 Should \fBipsec add\fR detach, allowing \fBauto=\fR to be performed in the background? .RE .SH "SEE ALSO" .PP \fBipsec\fR(8), \fBipsec.conf\fR(5), \fBipsec-delete\fR(8) \fBipsec-route\fR(8), \fBipsec-up\fR(8), .SH "BUGS" .PP none .SH "AUTHOR" Andrew Cagney, Tuomo Soini