diff --git a/src/etc/inc/ipsec.inc b/src/etc/inc/ipsec.inc
index d53d9f082506dd67659f699b856df5e84beca9f3..ad7840c244ba6be32a144ae1d7756d20895aeaff 100644
--- a/src/etc/inc/ipsec.inc
+++ b/src/etc/inc/ipsec.inc
@@ -1424,12 +1424,14 @@ function ipsec_setup_strongswan() {
 	$ssconf['charon']['plugins']['unity'] = array('load' => $unity_enabled);
 	$ssconf['charon']['plugins']['curve25519'] = array('load' => "yes");
 
-	$ssconf['charon']['plugins']['pkcs11'] = array();
-	$ssconf['charon']['plugins']['pkcs11']['load'] = "yes";
-	$ssconf['charon']['plugins']['pkcs11']['modules'] = array();
-	$ssconf['charon']['plugins']['pkcs11']['modules']['opensc'] = array();
-	$ssconf['charon']['plugins']['pkcs11']['modules']['opensc']['load_certs'] = "yes";
-	$ssconf['charon']['plugins']['pkcs11']['modules']['opensc']['path'] = "/usr/local/lib/opensc-pkcs11.so";
+	if (isset($config['ipsec']['pkcs11support'])) {
+		$ssconf['charon']['plugins']['pkcs11'] = array();
+		$ssconf['charon']['plugins']['pkcs11']['load'] = "yes";
+		$ssconf['charon']['plugins']['pkcs11']['modules'] = array();
+		$ssconf['charon']['plugins']['pkcs11']['modules']['opensc'] = array();
+		$ssconf['charon']['plugins']['pkcs11']['modules']['opensc']['load_certs'] = "yes";
+		$ssconf['charon']['plugins']['pkcs11']['modules']['opensc']['path'] = "/usr/local/lib/opensc-pkcs11.so";
+	}
 
 	/* Find RADIUS servers designated for Mobile IPsec user auth */
 	$radius_servers = array();
@@ -2715,6 +2717,8 @@ function ipsec_configure($restart = false) {
 		killbypid("{$g['varrun_path']}/filterdns-ipsec.pid");
 		/* Wait for process to die */
 		sleep(2);
+		/* Stop PC/SC Smart Card Services */
+		killbyname("pcscd");
 		/* Shutdown enc0 interface*/
 		mwexec("/sbin/ifconfig enc0 down");
 		ipsec_gre_default_mtu(); 
@@ -2722,6 +2726,20 @@ function ipsec_configure($restart = false) {
 	} else {
 		/* Startup enc0 interface */
 		mwexec("/sbin/ifconfig enc0 up");
+		/* PC/SC daemon must be started before strongswan */
+		if (isset($config['ipsec']['pkcs11support']) && !isvalidproc("pcscd")) {
+			if (platform_booting()) {
+				echo gettext("Starting PC/SC Smart Card Services...");
+			}
+			mwexec_bg("/usr/local/sbin/pcscd");
+			if (platform_booting()) {
+				echo gettext("done.\n");
+			}
+		} elseif (!isset($config['ipsec']['pkcs11support']) && isvalidproc("pcscd")) {
+			/* strongswan must be stopped first, otherwise it will flood the logs */
+			mwexec("/usr/local/sbin/strongswanrc stop");
+			killbyname("pcscd");
+		}
 	}
 
 	if (platform_booting()) {
diff --git a/src/etc/rc.bootup b/src/etc/rc.bootup
index 1939acb2286cf0c324ed1c5204c9cbbd27d63fa8..10b8f680bfd3c6fe0cd082297847a98931f16100 100755
--- a/src/etc/rc.bootup
+++ b/src/etc/rc.bootup
@@ -208,11 +208,6 @@ echo "Setting up interfaces microcode...";
 setup_microcode();
 echo "done.\n";
 
-/* pcscd daemon must be started before IPsec */
-echo "Starting PC/SC Smart Card Services...";
-mwexec_bg("/usr/local/sbin/pcscd");
-echo "done.\n";
-
 if (isset($config['system']['mds_disable']) &&
     (strlen($config['system']['mds_disable']) > 0)) {
 	set_single_sysctl("hw.mds_disable" , (int)$config['system']['mds_disable']);
diff --git a/src/usr/local/www/vpn_ipsec_phase1.php b/src/usr/local/www/vpn_ipsec_phase1.php
index a25fd7b60503db6a819c02ff9ac5b96b11eac22f..d546d582bc2cf8755ac6f2b6b66ed45e81717cfb 100644
--- a/src/usr/local/www/vpn_ipsec_phase1.php
+++ b/src/usr/local/www/vpn_ipsec_phase1.php
@@ -675,7 +675,7 @@ function build_interface_list() {
 }
 
 function build_auth_method_list() {
-	global $p1_authentication_methods, $pconfig;
+	global $p1_authentication_methods, $pconfig, $config;
 
 	$list = array();
 
@@ -683,6 +683,10 @@ function build_auth_method_list() {
 		if (!$pconfig['mobile'] && $method_params['mobile']) {
 			continue;
 		}
+		if (!isset($config['ipsec']['pkcs11support']) &&
+		    ($method_type == 'pkcs11')) {
+			continue;
+		}
 
 		$list[$method_type] = htmlspecialchars($method_params['name']);
 	}
diff --git a/src/usr/local/www/vpn_ipsec_settings.php b/src/usr/local/www/vpn_ipsec_settings.php
index ec3fb89bbfb1a8837ac14b9674bd90efbda006a7..f6a9eb2afea3d13f335f5b28d11127fd34249214 100644
--- a/src/usr/local/www/vpn_ipsec_settings.php
+++ b/src/usr/local/www/vpn_ipsec_settings.php
@@ -37,12 +37,16 @@ require_once("vpn.inc");
 
 global $ipsec_filtermodes;
 
+init_config_arr(array('ipsec', 'phase1'));
+$a_phase1 = &$config['ipsec']['phase1'];
+
 $pconfig['logging'] = ipsec_get_loglevels();
 $pconfig['unityplugin'] = isset($config['ipsec']['unityplugin']);
 $pconfig['strictcrlpolicy'] = isset($config['ipsec']['strictcrlpolicy']);
 $pconfig['makebeforebreak'] = isset($config['ipsec']['makebeforebreak']);
 $pconfig['noshuntlaninterfaces'] = isset($config['ipsec']['noshuntlaninterfaces']);
 $pconfig['compression'] = isset($config['ipsec']['compression']);
+$pconfig['pkcs11support'] = isset($config['ipsec']['pkcs11support']);
 $pconfig['enableinterfacesuse'] = isset($config['ipsec']['enableinterfacesuse']);
 $pconfig['acceptunencryptedmainmode'] = isset($config['ipsec']['acceptunencryptedmainmode']);
 $pconfig['maxexchange'] = $config['ipsec']['maxexchange'];
@@ -149,6 +153,28 @@ if ($_POST['save']) {
 			unset($config['ipsec']['compression']);
 		}
 
+		if ($_POST['pkcs11support'] == "yes") {
+			if (!isset($config['ipsec']['pkcs11support'])) {
+				$needsrestart = true;
+			}
+			$config['ipsec']['pkcs11support'] = true;
+		} elseif (isset($config['ipsec']['pkcs11support'])) {
+			foreach ($a_phase1 as $ph1ent) {
+				if (($ph1ent['authentication_method'] == 'pkcs11') &&
+				    !isset($ph1ent['disabled'])) {
+					$pkcs11phase1 = true;
+					break;
+				}
+			}
+			if ($pkcs11phase1) {
+				$input_errors[] = gettext("Unable to disable PKCS#11 support,
+				       	already in use for Phase 1 authentication.");
+			} else {
+				$needsrestart = true;
+				unset($config['ipsec']['pkcs11support']);
+			}
+		}
+
 		if ($_POST['enableinterfacesuse'] == "yes") {
 			if (!isset($config['ipsec']['enableinterfacesuse'])) {
 				$needsrestart = true;
@@ -364,6 +390,13 @@ $section->addInput(new Form_Checkbox(
 	$pconfig['compression']
 ))->setHelp('IPComp compression of content is proposed on the connection.');
 
+$section->addInput(new Form_Checkbox(
+	'pkcs11support',
+	'PKCS#11 Support',
+	'Enable PKCS#11',
+	$pconfig['pkcs11support']
+))->setHelp('Allow use of PKCS#11 tokens for Phase 1 authentication.');
+
 $section->addInput(new Form_Checkbox(
 	'enableinterfacesuse',
 	'Strict interface binding',
