diff --git a/defaults/main.yml b/defaults/main.yml
index 4f2458e..6ca42d9 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -35,6 +35,7 @@
 # Acceptable values are add, start, or route
 strongswan_conf_auto: "route"
 strongswan_conf_dpdaction: "clear"
+strongswan_conf_keyingtries: "3"
 
 # Whether rekeying of an IKE_SA should also reauthenticate the peer
 strongswan_conf_reauth: "no"
diff --git a/templates/ipsec.conf.j2 b/templates/ipsec.conf.j2
index 6a1ad85..67f4e6c 100644
--- a/templates/ipsec.conf.j2
+++ b/templates/ipsec.conf.j2
@@ -13,7 +13,7 @@
     keylife={{ strongswan_conf_phase2_lifetime }}
     lifetime={{ strongswan_conf_phase2_lifetime }}
     rekeymargin=3m
-    keyingtries=3
+    keyingtries={{ strongswan_conf_keyingtries }}
     keyexchange={{ strongswan_conf_key_exchange }}
     mobike=no
     ike={{ strongswan_conf_ike_cipher }}
@@ -36,5 +36,7 @@
     right={{ conn.right }}
     rightsubnet={{ conn.right_subnets }}
     rightauth={{ strongswan_conf_auth_type }}
+{% if conn.vti is defined %}
     mark=%unique
+{% endif %}
 {% endfor %}