Looks like this can hit us when upgrading to newer versions of Debian...
Found via: journalctl -u strongswan
Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'interfaces' in config setup Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'interfaces' in config setup Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'nat_traversal' in config setup Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'virtual_private' in config setup Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access-win-aaa' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'pfs' in conn 'remote-access-win-aaa' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access-mac-zzz' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'pfs' in conn 'remote-access-mac-zzz' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: # deprecated keyword 'pfs' in conn 'remote-access' Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec_starter[1962]: ### 9 parsing errors (0 fatal) ### Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'nat_traversal' in config setup Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'virtual_private' in config setup Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access-win-aaa' Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'pfs' in conn 'remote-access-win-aaa' Dec 09 14:34:22 CR1.mucI ipsec[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access-mac-zzz' Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'pfs' in conn 'remote-access-mac-zzz' Dec 09 14:34:22 CR1.mucI ipsec[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'leftnexthop' in conn 'remote-access' Dec 09 14:34:22 CR1.mucI ipsec[1962]: # deprecated keyword 'pfs' in conn 'remote-access' Dec 09 14:34:22 CR1.mucI ipsec[1962]: PFS is enabled by specifying a DH group in the 'esp' cipher suite Dec 09 14:34:22 CR1.mucI ipsec[1962]: ### 9 parsing errors (0 fatal) ###