NAME

       charon-cmd - Simple IKE client (IPsec VPN client)

SYNOPSIS

       charon-cmd --host hostname --identity identity [ options ]

DESCRIPTION

       charon-cmd  is  a  program  for  setting  up  IPsec VPN connections using the Internet Key
       Exchange protocol (IKE) in version 1 and 2.  It  supports  a  number  of  different  road-
       warrior scenarios.

       Like  the  IKE  daemon charon, charon-cmd has to be run as root (or more specifically as a
       user with CAP_NET_ADMIN capability).

       Of the following options at least --host and --identity are  required.  Depending  on  the
       selected authentication profile credentials also have to be provided with their respective
       options.

       Many of the  charon-specific  configuration  options  in  strongswan.conf  also  apply  to
       charon-cmd.  For instance, to configure customized logging to stdout the following snippet
       can be used:

            charon-cmd {
                 filelog {
                      stdout {
                           default = 1
                           ike = 2
                           cfg = 2
                      }
                 }
            }

OPTIONS

       --help Prints usage information and a short summary of the available options.

       --version
              Prints the strongSwan version.

       --debug level
              Sets the default log level (defaults to 1).  level is a number between  -1  and  4.
              Refer  to  strongswan.conf for options that allow a more fine-grained configuration
              of the logging output.

       --host hostname
              DNS name or IP address to connect to.

       --identity identity
              Identity the client uses for the IKE exchange.

       --eap-identity identity
              Identity the client uses for EAP authentication.

       --xauth-username username
              Username the client uses for XAuth authentication.

       --remote-identity identity
              Server identity to expect, defaults to hostname.

       --cert path
              Trusted certificate, either for  authentication  or  trust  chain  validation.   To
              provide more than one certificate multiple --cert options can be used.

       --rsa path
              RSA  private  key  to use for authentication (if a password is required, it will be
              requested on demand).

       --p12 path
              PKCS#12 file with private key and certificates to use for authentication and  trust
              chain validation (if a password is required it will be requested on demand).

       --agent[=socket]
              Use  SSH  agent  for authentication. If socket is not specified it is read from the
              SSH_AUTH_SOCK environment variable.

       --local-ts subnet
              Additional traffic selector to propose for  our  side,  the  requested  virtual  IP
              address will always be proposed.

       --remote-ts subnet
              Traffic selector to propose for remote side, defaults to 0.0.0.0/0.

       --ike-proposal proposal
              IKE  proposal to offer instead of default. For IKEv1, a single proposal consists of
              one encryption algorithm, an integrity/PRF algorithm and  a  DH  group.  IKEv2  can
              propose multiple algorithms of the same kind. To specify multiple proposals, repeat
              the option.

       --esp-proposal proposal
              ESP proposal to offer instead of default. For IKEv1, a single proposal consists  of
              one  encryption  algorithm,  an  integrity  algorithm  and an optional DH group for
              Perfect Forward Secrecy rekeying. IKEv2 can propose multiple algorithms of the same
              kind. To specify multiple proposals, repeat the option.

       --ah-proposal proposal
              AH  proposal  to  offer instead of ESP. For IKEv1, a single proposal consists of an
              integrity algorithm and an optional DH group for Perfect Forward Secrecy  rekeying.
              IKEv2  can  propose  multiple  algorithms  of  the  same  kind. To specify multiple
              proposals, repeat the option.

       --profile name
              Authentication profile to use, the list of supported profiles can be found  in  the
              Authentication  Profiles sections below. Defaults to ikev2-pub if a private key was
              supplied, and to ikev2-eap otherwise.

   IKEv2 Authentication Profiles
       ikev2-pub
              IKEv2 with public key client and server authentication

       ikev2-eap
              IKEv2 with EAP client authentication and public key server authentication

       ikev2-pub-eap
              IKEv2 with public key and EAP client  authentication  (RFC  4739)  and  public  key
              server authentication

   IKEv1 Authentication Profiles
       The  following authentication profiles use either Main Mode or Aggressive Mode, the latter
       is denoted with a -am suffix.

       ikev1-pub, ikev1-pub-am
              IKEv1 with public key client and server authentication

       ikev1-xauth, ikev1-xauth-am
              IKEv1 with public key client and server authentication, followed  by  client  XAuth
              authentication

       ikev1-xauth-psk, ikev1-xauth-psk-am
              IKEv1  with  pre-shared  key  (PSK)  client  and server authentication, followed by
              client XAuth authentication (INSECURE!)

       ikev1-hybrid, ikev1-hybrid-am
              IKEv1 with  public  key  server  authentication  only,  followed  by  client  XAuth
              authentication

SEE ALSO

       strongswan.conf(5), ipsec(8)