connections {
  road-warrior {
    version = 2
    proposals = aes256-sha256-modp2048,aes256-sha1-modp1024
    reauth_time = 28800
    dpd_delay = 10
    dpd_timeout = 120

    local {
      auth = pubkey
      certs = server.pem
      id = @{{ local_fqdn }}
    }

    remote {
      auth = eap-tls
      cacerts = ca.pem
      eap_id = %any
    }

    children {
      road-warrior {
        mode = tunnel
        local_ts = {{ local_ts }}
        remote_ts = dynamic
        esp_proposals = aes256-sha256,aes256-sha1
        life_time = 3600
        dpd_action = clear
        start_action = none
        close_action = none
      }
    }

    pools = rw-pool
  }
}

pools {
  rw-pool {
    addrs = {{ p2s_address_pool }}
    dns   = {{ p2s_dns }}
  }
}