| IPSEC-ADD(8) | Executable programs | IPSEC-ADD(8) |
.SH "NAME" ipsec-add, ipsec-ondemand - Add a connection
specification to pluto internal database from /etc/ipsec.conf
.SH "SYNOPSIS"
.HP 576u
ipsec add connection...
[ | --auto | route | up | keep
]
[--bg[={yes,no}] | [--asynchronous[={yes,no}]]
.HP 480u
ipsec add --autoall
[--bg[={yes,no}] | [--asynchronous[={yes,no}]]
.HP 576u
ipsec add --checkconfig
.HP 336u
ipsec add ...
[--dry-run]
[-n]
[--verbose]
[--config /etc/ipsec.conf]
[--ctlsocket /run/pluto/pluto.ctl]
.HP 696u
ipsec ondemand connection...
[--bg[={yes,no}] | [--asynchronous[={yes,no}]]
.SH "DESCRIPTION"
.PP The command ipsec add reads connection specifications from the
configuration file /etc/ipsec.conf and then loads them into
pluto:
.PP ipsec add connection...
The connection's specification is loaded into into pluto's internal connection database, and configured to accept connections from remote peers (see also --auto and --autoall). If a connection with same name already exists in pluto's connection database then the old connection's tunnels are torn down and the new connection specification replaces old one.
The option --auto specifies additional action to take once the connection is loaded: --auto=up also initiates the connection (see ipsec-up(8)); --auto=route routes the connection (make it on-demand) (see ipsec-route(8)).
This is equivalent to a connection with auto=add being loaded during startup.
By default, once all connections are loaded, ipsec add connection... will continue to monitor pluto's logs until additional actions, such as --auto=up, have completed (--asynchronous=no).
.RE
.PP ipsec add --autoall
Load all connection specifications with auto=add, auto=route, auto=up, or auto=keep. In addition, auto=route connections will be routed (made on-demand) and auto=up will be initiated.
By default, once all connections are loaded, ipsec add --autoall will disconnect from pluto. Additional actions, such as auto=up, will be performed in the background (--asynchronous=yes).
.RE
.PP ipsec add --checkconfig
Parse the configuration file, performing minimal validation. This will return 0 if config was valid. Optionally you can add --verbose for more detailed analysis.
.RE
.PP ipsec ondemand connection...
Load and then route (make on-demand) the connection.
This is equivalent to a connection with auto=route being loaded during startup.
.RE
.PP Note: if the new connection uses pre-shared key (PSK) authentication the
command ipsec rereadsecrets may also be needed as secrets keys are
only only read at startup.
.PP To inspect a loaded connection run ipsec connectionstatus
connection (see ipsec-connectionstatus(8))
and to remove it run ipsec delete connection
(see ipsec-delete(8));.
.PP The following additional options are supported by all variants of
ipsec add:
.PP --dry-run
-n
Do not pass the connections to pluto.
.RE
.PP --verbose
Increase verbosity.
.RE
.PP --config config-file
Specify an alternative configuration file to load.
The default is /etc/ipsec.conf.
.RE
.PP --ctlsocket socket-file
Specify an alternative control socket to use.
The default is /run/pluto/pluto.ctl.
.RE
.PP --asynchronous[={yes,no}
--bg[={yes,no}
Should ipsec add detach, allowing auto= to be performed in the background?
.RE
.SH "SEE ALSO"
.PP ipsec(8), ipsec.conf(5), ipsec-delete(8)
ipsec-route(8), ipsec-up(8),
.SH "BUGS"
.PP none
.SH "AUTHOR"
Andrew Cagney, Tuomo Soini
| 10/23/2026 | Libreswan v5.4.1-HEAD |