I have a small VPN set-up. The client in question is a Raspberry Pi running strongswan and xl2tpd to run as IPsec/L2TP. I made a configuration mistake on the client where I set pfs=yes (for perfect forward security) even though the server has it set to no. I fixed that, and now all is well, but the symptoms were curious and I wonder if someone can explain what I saw:

Namely, with the wrong configuration, the client was establishing a valid IPsec/L2TP connection, which could be verified on the server and worked on the client, BUT the connection consistently dropped at 2.1 minutes. I get that the configuration was broken and it should drop, but I'm wondering if there's a good explanation for why the connection could be established in the first place? It seems like this should have never connected rather than connecting for a while and then dropping.


The pfs=yes configuration just means that you want PFS. The pfs=no configuration means nothing -- it's just the equivalent to not having pfs=yes. It doesn't mean that you don't want PFS nor does it prohibit it.

But it's all academic since PFS is always used whether you want it or no.

  • Could you expand on that last sentence? That doesn't seem to match the documentation or my experience as described here. (If it does the same thing regardless of the setting, why would the result be different?) Thanks. – Brick Aug 9 '17 at 0:53
  • The behavior has changed in strongswan versions 5.0.0 and 5.1.0. I'm explaining the behavior you observed in the first paragraph. – David Schwartz Aug 9 '17 at 1:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.