set interfaces dummy dum0 address '10.10.0.2/32'
set interfaces ethernet eth2 address '192.0.2.2/30'
set interfaces tunnel tun0 address '10.0.0.2/30'
set interfaces tunnel tun0 encapsulation 'gre'
set interfaces tunnel tun0 multicast 'disable'
set interfaces tunnel tun0 remote '10.10.0.1'
set interfaces tunnel tun0 source-address '10.10.0.2'
set vpn ipsec esp-group ESP-GRP compression 'disable'
set vpn ipsec esp-group ESP-GRP lifetime '3600'
set vpn ipsec esp-group ESP-GRP mode 'tunnel'
set vpn ipsec esp-group ESP-GRP pfs 'dh-group14'
set vpn ipsec esp-group ESP-GRP proposal 1 encryption 'aes256'
set vpn ipsec esp-group ESP-GRP proposal 1 hash 'sha256'
set vpn ipsec ike-group IKE-GRP close-action 'none'
set vpn ipsec ike-group IKE-GRP dead-peer-detection action 'restart'
set vpn ipsec ike-group IKE-GRP dead-peer-detection interval '30'
set vpn ipsec ike-group IKE-GRP dead-peer-detection timeout '120'
set vpn ipsec ike-group IKE-GRP ikev2-reauth 'no'
set vpn ipsec ike-group IKE-GRP key-exchange 'ikev2'
set vpn ipsec ike-group IKE-GRP lifetime '28800'
set vpn ipsec ike-group IKE-GRP proposal 1 dh-group '14'
set vpn ipsec ike-group IKE-GRP proposal 1 encryption 'aes256'
set vpn ipsec ike-group IKE-GRP proposal 1 hash 'sha256'
set vpn ipsec interface 'eth2'
set vpn ipsec site-to-site peer 192.0.2.1 authentication id '192.0.2.2'
set vpn ipsec site-to-site peer 192.0.2.1 authentication mode 'pre-shared-secret'
set vpn ipsec site-to-site peer 192.0.2.1 authentication pre-shared-secret 'SuperPA$$swd'
set vpn ipsec site-to-site peer 192.0.2.1 connection-type 'initiate'
set vpn ipsec site-to-site peer 192.0.2.1 ike-group 'IKE-GRP'
set vpn ipsec site-to-site peer 192.0.2.1 ikev2-reauth 'inherit'
set vpn ipsec site-to-site peer 192.0.2.1 local-address '192.0.2.2'
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 esp-group 'ESP-GRP'
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 local prefix '10.10.0.2/32'
set vpn ipsec site-to-site peer 192.0.2.1 tunnel 1 remote prefix '10.10.0.1/32'

vyos@tstrtr2# sudo cat /etc/swanctl/swanctl.conf | grep children -A 20
        children {
            peer_192-0-2-1_tunnel_1 {
                esp_proposals = aes256-sha256-modp2048
                life_time = 3600s
                local_ts = 10.10.0.2/32
                remote_ts = 10.10.0.1/32
                ipcomp = no
                mode = tunnel
                start_action = start
                dpd_action = restart
                close_action = none
            }
            peer_192-0-2-1_tunnel_1_passthough {
                local_ts = 
                remote_ts = 
                start_action = trap
                mode = pass
            }
        }
    }

peer_192-0-2-1: #1, ESTABLISHED, IKEv2, be2a04e3a6e22022_i* 6b07c0ef01f6c28e_r
  local  '192.0.2.2' @ 192.0.2.2[4500]
  remote '192.0.2.1' @ 192.0.2.1[4500]
  AES_CBC-256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
  established 304s ago, rekeying in 26719s
  peer_192-0-2-1_tunnel_1: #1, reqid 1, INSTALLED, TUNNEL, ESP:AES_CBC-256/HMAC_SHA2_256_128
    installed 304s ago, rekeying in 3296s, expires in 3296s
    in  c35c85cf,    546 bytes,     4 packets
    out ce0b767f,      0 bytes,     0 packets
    local  10.10.0.2/32
    remote 10.10.0.1/32