swanctl

swanctl --list-sas is the first check on an IPsec tunnel. Each IKE SA shows its peer, state (ESTABLISHED) and algorithms; under it each CHILD SA (the tunnel proper) shows INSTALLED, TUNNEL or TUNNEL-in-UDP, its SPIs with bytes and packets in and out, and the networks it carries. Out growing while in stays put means packets leave and never come back. --load-all rereads /etc/swanctl/conf.d; --terminate --ike PEER ends a session (the next matching packet starts a new one). Why IKE failed is in the daemon's log.

swanctl command usage

swanctl --list-sas
swanctl --load-all
swanctl --terminate --ike NAME
swanctl --install|--uninstall --child NAME

Options

--list-sas

the IKE and CHILD SAs, with SPIs, counters and traffic selectors

--list-conns

the loaded connections, whether up or not

--load-all

reload connections and secrets from the config files

--terminate --ike NAME

end that IKE SA and its tunnels

--uninstall --child NAME

remove the policy that sends traffic into that tunnel

swanctl examples

swanctl --list-sas

Shows whether the tunnel is up, with which algorithms, and how much went each way.

swanctl --terminate --ike branchRouter

Tears the tunnel to branchRouter down; the next matching packet sets it up again with new keys.

tail -30 /var/log/netlab-ipsec.log

Shows the latest IKE messages and why a negotiation failed.

Pitfalls

• An established IKE SA proves only that the keys were agreed: ESP can still be blocked on the way. Compare the in and out counters.
• Both ends' traffic selectors must mirror each other, or IKE sets up no tunnel (TS_UNACCEPTABLE).

Run it on real machines