Strongswan configuration file

ipsec.conf

config setup
        uniqueids=no
        strictcrlpolicy=no

conn %default
        left=10.99.0.174
        leftid=vpn.domain.tld
        leftcert=jumpbox.pem
        leftsubnet=10.96.0.0/11
        leftfirewall=yes
        leftsendcert=always
        leftdns=10.99.0.174

        rightdns=10.99.0.174

        keyexchange=ikev2
        dpdaction=restart
        dpddelay=2400s
        fragmentation=yes
        forceencaps=yes
        compress=yes

        ikelifetime=12h
        keylife=7200s
        rekey=yes
        reauth=yes
        rekeymargin=9m
        keyingtries=2

ca domain
        cacert=domain.tld.pem
        auto=add

conn client_psk
        right=%any
        rightid=%any
        rightsourceip=10.100.0.0/24
        rightauth=psk
        type=tunnel
        auto=add

conn client_radius
        leftauth=pubkey
        right=%any
        rightid=%any
        rightsourceip=10.100.0.0/24
        rightauth=eap-radius
        eap_identity=%identity
        type=tunnel
        auto=add