<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I've configured a StrongSwan client in my lab with a 'conn' ipsec.conf section containing...<div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>left=%defaultroute</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftid=@TunnelGroupSiteA</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>...</div><div><br></div><div>...for establishment of a tunnel to a Cisco ASA. I've specified ikeversion=ikev1 and, for now, authby=psk.</div><div><br></div><div>Soon after negotiation begins (a few IKE messaged are exchanged), a message appears in the ASA log reporting that the incoming connection is for group '172.16.1.2' (my client's IP address) and the negotiation is then aborted since the tunnel group is named 'TunnelGroupSiteA' rather than '172.16.1.2'.</div><div><br></div><div>My reading of the wiki page that describes the ipsec.conf 'conn' section is that the value of 'leftid' is, by default, taken to be the same as the value of 'left' but that a 'leftid' assignment in the 'conn' section will be used instead if specified.</div><div><br></div><div>However, in this case, it appears that my 'leftid' specification is being ignored. Searching the web, I see that others have had success by creating a tunnel group on the ASA that has a name that is identical to the 'left' value (an IP address), but I do not have that flexibility since the production deployment will ultimately need to accommodate a large number of clients. The management overhead of configuring a tunnel for each would be unacceptable to the customer (and I wouldn't blame them, for that matter).</div><div><br></div><div>One forum posting I saw claimed that I need to specify the hex value of the tunnel group name ala...</div><div><br></div><div><span class="Apple-tab-span" style="white-space:pre"> </span>leftid=@#<hexdigits></div><div><br></div><div>...but this doesn't solve the problem. What's the correct solution for this? How do I get StrongSwan to use the 'leftid' value as the ASA tunnel group ID? </div><div><br></div><div><br></div><div>Bill<br><div apple-content-edited="true"> <span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0; "><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Anonymous; font-size: 13px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div><span class="Apple-style-span" style="font-family: Helvetica; font-size: 12px; "><div>--</div><div>William Bloom</div><div><a href="mailto:williambloom@mac.com">williambloom@mac.com</a></div><div><br class="webkit-block-placeholder"></div></span></div></span></span></div></span><br class="Apple-interchange-newline"> </div><br></div></body></html>