HEADS UP: IKEv1 is deprecated, move to IKEv2

[jimp]

strongSwan released 6.1.0 and they have started removing IKEv1 support. For now it is still present but has to be enabled at compile time:

https://www.strongswan.org/blog/2026/09/07/strongswan-6.1.0-released.html

strongSwan plans to remove IKEv1 entirely within the next year.

The new version is not in any builds yet, but it will be in the next release. So consider this an early warning to start moving those tunnels to IKEv2 NOW, do not wait.

We should be able to keep it working in the next release, but we will start adding warnings against its usage.

See #17088 and #17089.

IKEv2 is a lot easier to work with and a lot more forgiving in many ways, so hopefully it should be a smooth transition. The primary concern would be interacting with peers that do not support IKEv2, but hopefully these days that isn't as common.

IETF marked IKEv1 as deprecated almost 4 years ago.

EDIT: strongSwan 6.1.0 is now available for users on pfSense Plus software version 26.07 and 26.03.1 along with CE 2.9.0 and 2.8.1. To update strongSwan and other similar components, run pfSense-upgrade -dc; pkg update; pkg upgrade from an SSH or console shell.