<form>
    <tab id="ipsec-general" description="General">
        <field>
            <id>ipsec.general.preferred_oldsa</id>
            <label>Prefer older IPsec SAs</label>
            <type>checkbox</type>
            <help>
                By default, if several SAs match, the newest one is preferred if it's at least 30 seconds old.
                Select this option to always prefer old SAs over new ones.
            </help>
        </field>
        <field>
            <id>ipsec.general.disablevpnrules</id>
            <label>Disable legacy auto-added VPN rules.</label>
            <type>checkbox</type>
            <help>
                This option only applies to legacy tunnel configurations, connections do require manual firewall
                rules being setup.
            </help>
        </field>
        <field>
            <id>ipsec.general.passthrough_networks</id>
            <label>Passthrough networks</label>
            <type>select_multiple</type>
            <style>tokenize</style>
            <help>
                This exempts traffic for one or more subnets from getting processed by the IPsec stack in the kernel.
                When sending all traffic to the remote location, you probably want to add your lan network(s) here.
            </help>
        </field>
        <field>
            <id>ipsec.general.user_source</id>
            <label>Authentication (Xauth)</label>
            <type>select_multiple</type>
            <style>selectpicker</style>
            <help>Select authentication methods to use, leave empty if no challenge response authentication is needed.</help>
        </field>
        <field>
            <id>ipsec.general.local_group</id>
            <label>Enforce local group (Xauth)</label>
            <type>dropdown</type>
            <style>selectpicker</style>
            <help>Restrict access to users in the selected local group. Please be aware that other authentication backends will refuse to authenticate when using this option.</help>
        </field>
    </tab>
    <tab id="ipsec-eap-radius" description="eap-radius">
        <field>
            <id>ipsec.charon.plugins.eap-radius.servers</id>
            <label>Servers</label>
            <type>select_multiple</type>
            <help>RADIUS servers to configure</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.eap-radius.accounting</id>
            <label>Accounting</label>
            <type>checkbox</type>
            <help>Enable RADIUS accounting</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.eap-radius.class_group</id>
            <label>Group selection (class_group)</label>
            <type>checkbox</type>
        </field>
    </tab>
    <tab id="ipsec-xauth-pam" description="xauth-pam">
        <field>
            <id>ipsec.charon.plugins.xauth-pam.pam_service</id>
            <label>Pam_service</label>
            <type>text</type>
            <help>PAM service to use for authentication.</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.xauth-pam.session</id>
            <label>Session</label>
            <type>checkbox</type>
            <help>Open/close a PAM session for each active IKE_SA</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.xauth-pam.trim_email</id>
            <label>Trim_email</label>
            <type>checkbox</type>
            <help>If an email address is received as an XAuth username, trim it to just the username part</help>
        </field>
    </tab>
    <tab id="ipsec-charon" description="Charon">
        <field>
            <id>ipsec.charon.max_ikev1_exchanges</id>
            <label>Maximum IKEv1 phase 2 exchanges</label>
            <type>text</type>
            <help>
                Maximum number of IKEv1 phase 2 exchanges per IKE_SA to keep state about and track concurrently.
                When using multiple phase 2 definitions a higher value than the default (3) would be advisable to prevent re-keying issues
            </help>
        </field>
        <field>
            <id>ipsec.charon.ignore_acquire_ts</id>
            <label>Ignore acquire ts</label>
            <type>checkbox</type>
            <help>
                    If this is disabled the traffic selectors from the kernel’s acquire events,
                    which are derived from the triggering packet, are prepended to the traffic selectors from the
                    configuration for IKEv2 connection. By enabling this, such specific traffic selectors will be ignored and
                    only the ones in the config will be sent.
                    This always happens for IKEv1 connections as the protocol only supports one set of traffic selectors per CHILD SA
            </help>
        </field>
        <field>
            <id>ipsec.charon.threads</id>
            <label>Threads</label>
            <type>text</type>
            <help>
                Number of worker threads in Several of these are reserved for long running tasks in internal modules and plugins.
                Therefore, make sure you don’t set this value too low.
            </help>
        </field>
        <field>
            <id>ipsec.charon.ikesa_table_size</id>
            <label>IKESA table size</label>
            <type>text</type>
            <help>Size of the IKE SA hash table</help>
        </field>
        <field>
            <id>ipsec.charon.ikesa_table_segments</id>
            <label>IKESA table segments</label>
            <type>text</type>
            <help>Number of exclusively locked segments in the hash table.</help>
        </field>
        <field>
            <id>ipsec.charon.init_limit_half_open</id>
            <label>Init limit half open</label>
            <type>text</type>
            <help>Limit new connections based on the current number of half open IKE_SAs.</help>
        </field>
        <field>
            <id>ipsec.charon.make_before_break</id>
            <label>Make Before Break</label>
            <type>checkbox</type>
            <help>Initiate IKEv2 reauthentication with a make-before-break instead of a break-before-make scheme. Make-before-break uses overlapping IKE and CHILD SA during reauthentication by first recreating all new SAs before deleting the old ones. This behavior can be beneficial to avoid connectivity gaps during reauthentication, but requires support for overlapping SAs by the peer.</help>
        </field>
        <field>
            <id>ipsec.charon.install_routes</id>
            <label>Install routes</label>
            <type>checkbox</type>
            <help>Install routes into a separate routing table for established IPsec tunnels. If disabled a more efficient lookup for source and next-hop addresses is used.</help>
        </field>
        <field>
            <id>ipsec.charon.cisco_unity</id>
            <label>Cisco Unity</label>
            <type>checkbox</type>
            <help>Send Cisco Unity vendor ID payload (IKEv1 only).</help>
        </field>
        <field>
            <type>header</type>
            <label>Retransmission</label>
        </field>
        <field>
            <id>ipsec.charon.retransmit_tries</id>
            <label>Tries</label>
            <type>text</type>
            <help>Number of retransmissions to send before giving up.</help>
        </field>
        <field>
            <id>ipsec.charon.retransmit_timeout</id>
            <label>Timeout</label>
            <type>text</type>
            <help>Timeout in seconds.</help>
        </field>
        <field>
            <id>ipsec.charon.retransmit_base</id>
            <label>Base</label>
            <type>text</type>
            <help>Base of exponential backoff</help>
        </field>
        <field>
            <id>ipsec.charon.retransmit_jitter</id>
            <label>Jitter</label>
            <type>text</type>
            <help>Maximum jitter in percent to apply randomly to calculated retransmission timeout (0 to disable)</help>
        </field>
        <field>
            <id>ipsec.charon.retransmit_limit</id>
            <label>Limit</label>
            <type>text</type>
            <help>Upper limit in seconds for calculated retransmission timeout (0 to disable)</help>
        </field>
    </tab>
    <tab id="ipsec-syslog" description="Syslog">
        <field>
            <type>header</type>
            <label>Generic settings</label>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.ike_name</id>
            <label>Ike Name</label>
            <type>checkbox</type>
            <help>Prefix each log entry with the connection name and a unique numerical identifier for each IKE_SA.</help>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.log_level</id>
            <label>Log Level</label>
            <type>checkbox</type>
            <help>Add the log level of each message after the subsystem (e.g. [IKE2]).</help>
        </field>
        <field>
            <type>header</type>
            <label>Loglevel</label>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.app</id>
            <label>Applications other than daemons</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.asn</id>
            <label>Low-level encoding/decoding (ASN.1, X.509 etc.)</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.cfg</id>
            <label>Configuration management and plugins</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.chd</id>
            <label>CHILD_SA/IPsec SA</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.dmn</id>
            <label>Main daemon setup/cleanup/signal handling</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.enc</id>
            <label>Packet encoding/decoding encryption/decryption operations</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.esp</id>
            <label>libipsec library messages</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.ike</id>
            <label>IKE_SA/ISAKMP SA</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.imc</id>
            <label>Integrity Measurement Collector</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.imv</id>
            <label>Integrity Measurement Verifier</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.job</id>
            <label>Jobs queuing/processing and thread pool management</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.knl</id>
            <label>IPsec/Networking kernel interface</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.lib</id>
            <label>libstrongwan library messages</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.mgr</id>
            <label>IKE_SA manager, handling synchronization for IKE_SA access</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.net</id>
            <label>IKE network communication</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.pts</id>
            <label>Platform Trust Service</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.tls</id>
            <label>libtls library messages</label>
            <type>dropdown</type>
        </field>
        <field>
            <id>ipsec.charon.syslog.daemon.tnc</id>
            <label>Trusted Network Connect</label>
            <type>dropdown</type>
        </field>
    </tab>
    <tab id="ipsec-attr" description="Attr">
        <field>
            <id>ipsec.charon.plugins.attr.subnet</id>
            <label>Subnet</label>
            <type>select_multiple</type>
            <style>tokenize</style>
            <allownew>true</allownew>
            <help>The protected sub-networks that this edge-device protects (in CIDR notation). Usually ignored in deference to local_ts, though macOS clients will use this for routes</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.dns</id>
            <label>DNS</label>
            <type>select_multiple</type>
            <style>tokenize</style>
            <allownew>true</allownew>
            <help>DNS server</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.nbns</id>
            <label>NBNS</label>
            <type>select_multiple</type>
            <style>tokenize</style>
            <allownew>true</allownew>
            <help>WINS server</help>
        </field>
        <field>
            <type>header</type>
            <label>Cisco Unity</label>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.split-include</id>
            <label>Split-include</label>
            <type>select_multiple</type>
            <style>tokenize</style>
            <allownew>true</allownew>
            <help>Comma-separated list of subnets to tunnel. The unity plugin provides a connection specific approach to assign this attribute.</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.x_28674</id>
            <label>Default search</label>
            <type>text</type>
            <help>Default search domain used when resolving host names via the assigned DNS servers</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.x_28675</id>
            <label>Split DNS name</label>
            <type>text</type>
            <help>If split tunneling is used clients might not install the assigned DNS servers globally. This space-separated list of domain names allows clients, such as macOS, to selectively query the assigned DNS servers. Seems Mac OS X uses only the first item in the list</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.x_28672</id>
            <label>Login banner</label>
            <type>textbox</type>
            <help>Message displayed on certain clients after login</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.x_28673</id>
            <label>Save password</label>
            <type>checkbox</type>
            <help>Allow client to save Xauth password in local storage</help>
        </field>
        <field>
            <id>ipsec.charon.plugins.attr.x_28679</id>
            <label>PFS group</label>
            <type>dropdown</type>
        </field>
    </tab>
    <activetab>ipsec-general</activetab>
</form>
