/etc/ipsec.d/tunnel.conf

conn frankfurt
        type=tunnel
        keylife=60m
        keyingtries=2
        left=<aws EIP>
        leftsubnet=awssubnet/16
        leftnexthop=awsubnet.1
        right=<office IP>
        rightsubnet=officesubet/21
        rightnexthop=office.1
        authby=secret
        auto=start
        pfs=yes
        keyexchange=ike
        remote_peer_type=cisco
        auth=esp
        ike=aes256-sha1;modp1024
        ikelifetime=28800s
        phase2alg=aes256-sha1;modp1024
        forceencaps=yes
        left=%defaultroute

/etc/ipsec.conf
grep -v \# /etc/ipsec.conf


config setup
        protostack=netkey
        dumpdir=/var/run/pluto/
        nat_traversal=yes