Might be some race issue with network being up. Unlikely to be related to systemd itself, though.

I understand systemd affects the boot.
Why, then, as I do systemctl restart ipsec, everything becomes normal?

Or are you saying that is not correct file:
usr/lib/systemd/syst/ipsec.service

[Unit]
Description=Internet Key Exchange (IKE) Protocol Daemon for IPsec
After=syslog.target
After=network.target
#After=remote-fs.target

[Service]
Type=simple
Restart=always
# backwards compatible with plutorestartoncrash=no
#RestartPreventExitStatus=137 143 SIGTERM SIGKILL
EnvironmentFile=-/etc/sysconfig/pluto
#Environment=IPSEC_LIBDIR=/usr/libexec/ipsec
#Environment=IPSEC_SBINDIR=/usr/sbin
#Environment=IPSEC_EXECDIR=/usr/libexec/ipsec/ipsec
#PIDFile=/var/run/pluto/pluto.pid
#
ExecStartPre=/usr/sbin/ipsec addconn --config /etc/ipsec.conf --checkconfig
ExecStartPre=/usr/libexec/ipsec/_stackmanager start
ExecStart=/bin/sh -c 'eval `/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork $PLUTO_OPTIONS`'
ExecStop=/usr/sbin/ipsec whack --shutdown
ExecStopPost=/sbin/ip xfrm policy flush
ExecStopPost=/sbin/ip xfrm state flush
ExecReload=/usr/sbin/ipsec whack --listen

[Install]
WantedBy=multi-user.target
Alias=libreswan.service

I think the authors libreswan do not care who and how it runs.

(In reply to mx from comment #2)
> I understand systemd affects the boot.
Sure. So does the e.g. bash.

> Why, then, as I do systemctl restart ipsec, everything becomes normal?
Probably because some conditions which are necessary for ipsec to start were not satisfied the first time, but are later on.

> Or are you saying that is not correct file:
> usr/lib/systemd/syst/ipsec.service
> 
> [Unit]
> Description=Internet Key Exchange (IKE) Protocol Daemon for IPsec
> After=syslog.target
Don't need this line.

> After=network.target
This means that network interfaces are up (see http://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/).

> #After=remote-fs.target
> 
> [Service]
> Type=simple
> Restart=always
> # backwards compatible with plutorestartoncrash=no
> #RestartPreventExitStatus=137 143 SIGTERM SIGKILL
> EnvironmentFile=-/etc/sysconfig/pluto
> #Environment=IPSEC_LIBDIR=/usr/libexec/ipsec
> #Environment=IPSEC_SBINDIR=/usr/sbin
> #Environment=IPSEC_EXECDIR=/usr/libexec/ipsec/ipsec
> #PIDFile=/var/run/pluto/pluto.pid
> #
> ExecStartPre=/usr/sbin/ipsec addconn --config /etc/ipsec.conf --checkconfig
> ExecStartPre=/usr/libexec/ipsec/_stackmanager start
> ExecStart=/bin/sh -c 'eval `/usr/libexec/ipsec/pluto --config
> /etc/ipsec.conf --nofork $PLUTO_OPTIONS`'
Why not
ExecStart=/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork $PLUTO_OPTIONS
?

> ExecStop=/usr/sbin/ipsec whack --shutdown
> ExecStopPost=/sbin/ip xfrm policy flush
> ExecStopPost=/sbin/ip xfrm state flush
> ExecReload=/usr/sbin/ipsec whack --listen
> 
> [Install]
> WantedBy=multi-user.target
> Alias=libreswan.service
> 
> I think the authors libreswan do not care who and how it runs.

So, I don't see anything in the unit file that would be clearly wrong. I don't know too much about ipsec, haven't used it for years. Where is is loading "host cert with nick name 'server01'" from? Does this require network access or some specific service to run or an access to some filesystem other than root?

section with server01 or as not related to the launch of section CERT-CLIENT03.
are other options for other profiles.
Please contact us do not pay attention to them.

> Why not
> ExecStart=/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork 
> $PLUTO_OPTIONS
> ?
I do not know. This file is in the package of this, it may not work as it should?

i changed line to :
ExecStart=/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork $PLUTO_OPTIONS

Failed resultat:
---
[root@n5050 ~]# ipsec auto --up CERT-CLIENT03
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
[root@n5050 ~]# ipsec auto --up CERT-CLIENT03
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
[root@n5050 ~]# systemctl restart ipsec
[root@n5050 ~]# ipsec auto --up CERT-CLIENT03
whack: Pluto is not running (no "/var/run/pluto/pluto.ctl")
[root@n5050 ~]# systemctl status ipsec
ipsec.service - Internet Key Exchange (IKE) Protocol Daemon for IPsec
   Loaded: loaded (/usr/lib/systemd/system/ipsec.service; enabled)
   Active: failed (Result: start-limit) since Пн 2013-11-04 21:04:27 MSK; 41s ago
  Process: 2966 ExecStopPost=/sbin/ip xfrm state flush (code=exited, status=0/SUCCESS)
  Process: 2964 ExecStopPost=/sbin/ip xfrm policy flush (code=exited, status=0/SUCCESS)
  Process: 2961 ExecStop=/usr/sbin/ipsec whack --shutdown (code=exited, status=1/FAILURE)
  Process: 2959 ExecStart=/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork $PLUTO_OPTIONS (code=exited, status=1/FAILURE)
  Process: 2898 ExecStartPre=/usr/libexec/ipsec/_stackmanager start (code=exited, status=0/SUCCESS)
  Process: 2895 ExecStartPre=/usr/sbin/ipsec addconn --config /etc/ipsec.conf --checkconfig (code=exited, status=0/SUCCESS)

ноя 04 21:04:27 n5050.home systemd[1]: ipsec.service: control process exited, code=exited status=1
ноя 04 21:04:27 n5050.home systemd[1]: Unit ipsec.service entered failed state.
ноя 04 21:04:27 n5050.home systemd[1]: ipsec.service holdoff time over, scheduling restart.
ноя 04 21:04:27 n5050.home systemd[1]: Stopping Internet Key Exchange (IKE) Protocol Daemon for ...c...
ноя 04 21:04:27 n5050.home systemd[1]: Starting Internet Key Exchange (IKE) Protocol Daemon for ...c...
ноя 04 21:04:27 n5050.home systemd[1]: ipsec.service start request repeated too quickly, refusin...art.
ноя 04 21:04:27 n5050.home systemd[1]: Failed to start Internet Key Exchange (IKE) Protocol Daem...sec.
ноя 04 21:04:27 n5050.home systemd[1]: Unit ipsec.service entered failed state.

(In reply to mx from comment #4)
> section with server01 or as not related to the launch of section
> CERT-CLIENT03.
> are other options for other profiles.
> Please contact us do not pay attention to them.
OK.
 
> > Why not
> > ExecStart=/usr/libexec/ipsec/pluto --config /etc/ipsec.conf --nofork 
> > $PLUTO_OPTIONS
> > ?
> I do not know. This file is in the package of this, it may not work as it
> should?
It's just inefficient and ugly, that's all.

I the network is configured by NetworkManager, can you try:

systemctl enable NetworkManager-wait-online.service

(The meaning is described in the wiki link I posted above).

The reason for the "eval" construct is to avoid failures when environment variables are unset and used on a systemd line. So if PLUTO_OPTIONS is unset, it will still run properly using an eval, but it would die if not using eval.

This might indeed be related to network manager. Let me know if the workaround of comment #6 works

I use : systemctl enable NetworkManager-wait-online.service
and its works !

Thank you all !