diff --git a/net/strongswan/files/etc/uci-defaults/strongswan b/net/strongswan/files/etc/uci-defaults/strongswan
index 894806daee..bfe4df5431 100644
--- a/net/strongswan/files/etc/uci-defaults/strongswan
+++ b/net/strongswan/files/etc/uci-defaults/strongswan
@@ -139,6 +139,63 @@ migrate_local_sourceip() {
 	config_foreach migrate_local_sourceip_vips remote
 }
 
+migrate_to_child() {
+	local tunnel_sections=""
+	local transport_sections=""
+	local remote_sections=""
+
+	local section
+
+	collect_tunnel() {
+		tunnel_sections="${tunnel_sections} $1"
+	}
+	collect_transport() {
+		transport_sections="${transport_sections} $1"
+	}
+	collect_remote() {
+		remote_sections="${remote_sections} $1"
+	}
+
+	config_load "ipsec"
+	config_foreach collect_tunnel "tunnel"
+	config_foreach collect_transport "transport"
+	config_foreach collect_remote "remote"
+
+	migrate_simple() {
+		local cfg="$1"
+		local mode="$2"
+
+		uci set ipsec.${cfg}=child
+		uci -q set ipsec.${cfg}.mode="$mode"
+	}
+
+	for section in $tunnel_sections; do
+		migrate_simple "$section" "tunnel"
+	done
+
+	for section in $transport_sections; do
+		migrate_simple "$section" "transport"
+	done
+
+	for section in $remote_sections; do
+		local tunnel_refs=""
+		local transport_refs=""
+
+		config_get tunnel_refs "$section" tunnel ""
+		config_get transport_refs "$section" transport ""
+
+		if [ -n "$tunnel_refs" ] || [ -n "$transport_refs" ]; then
+			uci -q delete ipsec.${section}.tunnel
+			uci -q delete ipsec.${section}.transport
+			for ref in $tunnel_refs $transport_refs; do
+				uci add_list ipsec.${section}.child="$ref"
+			done
+		fi
+	done
+
+	uci commit ipsec
+}
+
 main() {
 	migrate_ipsec
 	migrate_ignore_routing_tables
@@ -147,6 +204,7 @@ main() {
 	migrate_remote_gateway
 	migrate_local_ip
 	migrate_local_sourceip
+	migrate_to_child
 }
 
 main
diff --git a/net/strongswan/files/swanctl.init b/net/strongswan/files/swanctl.init
index 53d3100b80..7e6cae2152 100644
--- a/net/strongswan/files/swanctl.init
+++ b/net/strongswan/files/swanctl.init
@@ -221,10 +221,9 @@ iter_ike_proposal() {
 }
 
 config_child() {
-	# Generic ipsec conn section shared by tunnel and transport
 	local conf="$1"
-	local mode="$2"
 
+	local mode
 	local startaction
 	local updown
 	local firewall
@@ -245,6 +244,7 @@ config_child() {
 	local local_subnet
 	local remote_subnet
 
+	config_get mode "$conf" mode
 	config_get startaction "$conf" startaction "route"
 	config_get updown "$conf" updown ""
 	config_get firewall "$conf" firewall ""
@@ -266,6 +266,14 @@ config_child() {
 	config_list_foreach "$conf" local_subnet append_var local_subnet ","
 	config_list_foreach "$conf" remote_subnet append_var remote_subnet ","
 
+	case "$mode" in
+		tunnel|transport)
+			;;
+		*)
+			fatal "mode value '$mode' invalid"
+		;;
+	esac
+
 	local esp_proposal
 	iter_esp_proposal "$conf" esp_proposal
 
@@ -373,14 +381,6 @@ config_child() {
 	swanctl_xappend3 "}"
 }
 
-config_tunnel() {
-	config_child "$1" "tunnel"
-}
-
-config_transport() {
-	config_child "$1" "transport"
-}
-
 config_pool() {
 	local conf="$1"
 
@@ -570,9 +570,7 @@ config_remote() {
 
 	swanctl_xappend2 "children {"
 
-	config_list_foreach "$conf" tunnel config_tunnel
-
-	config_list_foreach "$conf" transport config_transport
+	config_list_foreach "$conf" child config_child
 
 	swanctl_xappend2 "}"