List established strongSwan IKE and IPsec security associations
Build a paste-ready command, then review its compatibility and effects before running it.
sudo swanctl --list-sasread-onlyrequires privileges Compatibility
LinuxVerified for Linux using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-19
Requirementsswanctlswanctl must be installed and available on PATH.Elevated accessReview the exact scope before using an elevated account.
Version supportswanctl Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsoffice: #3, ESTABLISHED, IKEv2, 91ac4f_i* 72be10_rRepresentative successful output; values vary with the selected target and system state.
Known errorsswanctl: command not foundswanctl is missing or is not available on PATH.Permission deniedThe current identity does not have the required access.
Verifysudo swanctl --list-sasThe output matches the expected target and exits without an error.Rollback noteNo universal automatic rollback is available. Capture the current state and use the tool-specific recovery procedure before applying changes.
Command breakdown
01sudoPrivilege elevationRuns the following command with elevated privileges after authorization.
02swanctlCommandRuns the swanctl stage of this one-liner.
03--list-sasOptionLists active IKE and child security associations managed by strongSwan.
Example input
sudo swanctl --list-sas
Example output
office: #3, ESTABLISHED, IKEv2, 91ac4f_i* 72be10_r
local 'vpn01@example.com' @ 203.0.113.10[4500]
remote 'branch@example.net' @ 198.51.100.20[4500]
branch: #2, reqid 1, INSTALLED, TUNNEL, ESP:AES_GCM_16-256
Illustrative output — exact values vary by system and data.
Official sources