'\" t
.\"     Title: IPSEC-DOWN
.\"    Author: [see the "AUTHOR" section]
.\" Generator: DocBook XSL Stylesheets v1.79.2 <http://docbook.sf.net/>
.\"      Date: 10/06/2026
.\"    Manual: Executable programs
.\"    Source: Libreswan v5.4.1-HEAD
.\"  Language: English
.\"
.TH "IPSEC\-DOWN" "8" "10/06/2026" "Libreswan v5.4.1-HEAD" "Executable programs"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------

  
  .SH "NAME"
ipsec-down \- Down all tunnels sharing same IPsec connection\&.

  
  .SH "SYNOPSIS"

    .HP \w'\fBipsec\ down\fR\ 'u

      \fBipsec down\fR
       \fIconnection\fR
       [\-\-ctlsocket\ \fI/run/pluto/pluto\&.ctl\fR]
    

  

  .SH "DESCRIPTION"

    
    .PP
\fBipsec down\fR
commands pluto to tear down all connections matching specified
\fIconnection\fR
in internal configuration database\&. This connection definitions in place so remotes can immediately connect back\&. If you want tunnel to go permanently down, use
\fBipsec delete\fR
instead\&.

    .PP
Normally, pluto\*(Aqs route to a destination remains in place when an
\fBipsec down\fR
is used to take the connection down (or if connection setup, or later automatic rekeying, fails)\&. This permits establishing a new connection (perhaps using a different specification; the route is altered as necessary) without having a \(lqwindow\(rq in which packets might go elsewhere based on a more general route\&. Such a route can be removed using the
\fBipsec unroute\fR
operation (and is implicitly removed by
\fBipsec delete\fR)\&.

  

  .SH "SEE ALSO"

    
    .PP
\fBipsec.conf\fR(5),
\fBipsec\fR(8),
\fBipsec-add\fR(8),
\fBipsec-algparse\fR(8),
\fBipsec-briefconnectionstatus\fR(8),
\fBipsec-briefstatus\fR(8),
\fBipsec-certutil\fR(8),
\fBipsec-checkconfig\fR(8),
\fBipsec-checknflog\fR(8),
\fBipsec-checknss\fR(8),
\fBipsec-connectionstatus\fR(8),
\fBipsec-crlutil\fR(8),
\fBipsec-delete\fR(8),
\fBipsec-ecdsasigkey\fR(8),
\fBipsec-fetchcrls\fR(8),
\fBipsec-fipsstatus\fR(8),
\fBipsec-globalstatus\fR(8),
\fBipsec-import\fR(8),
\fBipsec-initnss\fR(8),
\fBipsec-letsencrypt\fR(8),
\fBipsec-listall\fR(8),
\fBipsec-listcacerts\fR(8),
\fBipsec-listcerts\fR(8),
\fBipsec-listcrls\fR(8),
\fBipsec-listen\fR(8),
\fBipsec-listpubkeys\fR(8),
\fBipsec-modutil\fR(8),
\fBipsec-newhostkey\fR(8),
\fBipsec-ondemand\fR(8),
\fBipsec-pk12util\fR(8),
\fBipsec-pluto\fR(8),
\fBipsec-purgeocsp\fR(8),
\fBipsec-redirect\fR(8),
\fBipsec-replace\fR(8),
\fBipsec-rereadall\fR(8),
\fBipsec-rereadcerts\fR(8),
\fBipsec-rereadsecrets\fR(8),
\fBipsec-restart\fR(8),
\fBipsec-route\fR(8),
\fBipsec-rsasigkey\fR(8),
\fBipsec-setup\fR(8),
\fBipsec-showhostkey\fR(8),
\fBipsec-showroute\fR(8),
\fBipsec-showstates\fR(8),
\fBipsec-shuntstatus\fR(8),
\fBipsec-start\fR(8),
\fBipsec-status\fR(8),
\fBipsec-stop\fR(8),
\fBipsec-trafficstatus\fR(8),
\fBipsec-unroute\fR(8),
\fBipsec-up\fR(8),
\fBipsec-vfychain\fR(8),
\fBipsec-whack\fR(8)

  

  .SH "BUGS"

    
    .PP
none

  

  .SH "AUTHOR"

    
    
    Andrew Cagney, Tuomo Soini