conn frankfurt
        type=tunnel
        keylife=60m
        keyingtries=2
        left=<aws EIP>
        leftsubnet=awssubnet/16
        leftnexthop=awsubnet.1
        right=<office IP>
        rightsubnet=officesubet/21
        rightnexthop=office.1
        authby=secret
        auto=start
        pfs=yes
        keyexchange=ike
        remote_peer_type=cisco
        auth=esp
        ike=aes256-sha1;modp1024
        ikelifetime=28800s
        phase2alg=aes256-sha1;modp1024
        forceencaps=yes
        left=%defaultroute