0) This file needs updating, see also https://www.openswan.org/ 1) There is some regression with the new parser and recognising "time values" (eg 3600, 1h, 10m) when they are just integers. So where keylife=3600 will not work, keylife="3600" or keylife=1h will work. 2) We are aware of problems where more than 10 initiations/second may cause the system to fail to negotiate ANY SAs. We are not certain of the cause, but it is not made better by setting nhelpers=0. Note that our previous record for SA setups/second was 11/second, so it may well be availability of entropy. 3) There are some interop issues with IKEv2