BSD ipsec.conf

# ipsec.conf - strongSwan IPsec configuration file

config setup
#       uniqueids=yes
#       charondebug="cfg 2, lib 1, dmn 1, ike 5, net 1, knl 1"


conn %default
        keyexchange=ikev2
        dpdaction=clear
#       ike=aes128gcm16-aesxcbc-modp2048
        #esp=aes128gcm16 # No kernel support for GCM without libipsec. kernel-pfroute fails to install routes via libipsec and isn't compiled in.
        dpddelay=300s
        rekey=no
        left=host.name
        leftsubnet=0.0.0.0/0,::/0
        leftcert=host.name.cert.pem
        right=%any
        rightsourceip=192.168.2.100/30#, 2400:6180:0100:00D0:0000:0000:0055:D100/64
        rightdns=8.8.8.8#, 2001:4860:4860::8844, 2001:4860:4860::8888, 8.8.4.4
        leftfirewall=yes
#       forceencaps=yes
        compress=yes
        auto=start

conn radius
    left=host.name
    leftcert=host.name.cert.pem
    leftsubnet=0.0.0.0/0
    right=%any
    rightauth=eap-radius
    eap_identity=%identity
    auto=add

conn IPSec-IKEv2
        keyexchange=ikev2
        auto=add