<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Hello StrongSwan guys,<div><br></div><div>I'm trying to build strongswan 5.0.1 compiled form source on CentOS 6.3 VPN server based on certificate+xauth as my goal is to connect various apple devices and different MAC OS versions.</div><div>I followed this guide very closely: <a href="http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)">http://wiki.strongswan.org/projects/strongswan/wiki/IOS_%28Apple%29</a>, I'm jumping directly on the results so far: </div><div>Test topology:</div><div>Servers IP 192.168.17.118 (certificates are generated with CN:192.168.17.118 and altsubj: 192.168.17.118)</div><div>For all devices I used the same certificates for testing, and made root certificate trusted on Lion and Mountain Lion. In all Configuration below I used build in VPN client (Cisco IPSec) with client certificate and xauth username and password.</div><div>I test it with IPhone 3G iOS 4.2.1 - it's connecting fine.</div><div>Snow Leopard IP 192.168.17.137 in the log - connects just fine</div><div>Lion v.10.7.4 - can't connect I guess it does not connect because of the same reason as Mountain Lion.</div><div>Mountain Lion v.10.8.2 IP 192.168.17.250 in the log - can't connect.</div><div><br></div><div>Here is my<b> ipsec.conf:</b></div><div><div>config setup</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>charondebug="dmn 1, mgr 1, ike 1, chd 1, job 1, cfg 1, knl 1, net 1, asn 1, enc 1, lib 1, esp 1, tls 1"</div><div><br></div><div>conn %default</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>ikelifetime=60m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keylife=20m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rekeymargin=3m</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>keyingtries=1</div><div><br></div><div><br></div><div>conn xarsa</div><div> authby=xauthrsasig</div><div> xauth=server</div><div> left=%defaultroute</div><div> leftsubnet=0.0.0.0/0</div><div> leftfirewall=yes</div><div> leftcert=serverCert.pem</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>right=%any</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsubnet=10.0.0.0/24</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightsourceip=10.0.0.2</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>rightcert=clientCert.pem</div><div><span class="Apple-tab-span" style="white-space:pre"> </span>auto=add</div></div><div><b><br></b></div><div><b>ipsec.secrets:</b></div><div><div>#include /etc/ipsec.d/*.secrets</div><div># /etc/ipsec.secrets - strongSwan IPsec secrets file</div><div><br></div><div>: RSA serverKey.pem</div><div>mve : XAUTH "12345"</div></div><div><br></div><div><b>/var/log/messages:</b></div><div><div><font size="1">Oct 27 03:29:54 ir1 charon: 00[DMN] loaded plugins: charon aes des sha1 sha2 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem fips-prf gmp xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 00[JOB] spawning 16 worker threads</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] received stroke: add connection 'xarsa'</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] left nor right host is our side, assuming left=local</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] adding virtual IP address pool 10.0.0.2</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] loaded certificate "C=BG, O=MYVPN, CN=192.168.17.118" from 'serverCert.pem'</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] id '%any' not confirmed by certificate, defaulting to 'C=BG, O=MYVPN, CN=192.168.17.118'</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] loaded certificate "C=BG, O=MYVPN, CN=ML" from 'clientCert.pem'</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] id '%any' not confirmed by certificate, defaulting to 'C=BG, O=MYVPN, CN=ML'</font></div><div><font size="1">Oct 27 03:29:54 ir1 charon: 11[CFG] added configuration 'xarsa'</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received NAT-T (RFC 3947) vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received XAuth vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received Cisco Unity vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] received DPD vendor ID</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[IKE] 192.168.17.137 is initiating a Main Mode IKE_SA</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[ENC] generating ID_PROT response 0 [ SA V V V ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 12[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 13[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 13[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 13[IKE] sending cert request for "C=BG, O=MYVPN, CN=MYVPN CA"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 13[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 13[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[ENC] parsed ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[IKE] ignoring certificate request without data</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[IKE] received end entity cert "C=BG, O=MYVPN, CN=ML"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] looking for XAuthInitRSA peer configs matching 192.168.17.118...192.168.17.137[C=BG, O=MYVPN, CN=ML]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] selected peer config "xarsa"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] using trusted ca certificate "C=BG, O=MYVPN, CN=MYVPN CA"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] checking certificate status of "C=BG, O=MYVPN, CN=ML"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] certificate status is not available</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] reached self-signed root ca with a path length of 0</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[CFG] using trusted certificate "C=BG, O=MYVPN, CN=ML"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[IKE] authentication of 'C=BG, O=MYVPN, CN=ML' with RSA successful</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[IKE] authentication of 'C=BG, O=MYVPN, CN=192.168.17.118' (myself) successful</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[IKE] sending end entity cert "C=BG, O=MYVPN, CN=192.168.17.118"</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[ENC] generating TRANSACTION request 1934430434 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:00 ir1 charon: 14[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 15[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 15[ENC] parsed TRANSACTION response 1934430434 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 15[IKE] XAuth authentication of 'mve' successful</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 15[ENC] generating TRANSACTION request 3053698936 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 15[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 16[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 16[ENC] parsed TRANSACTION response 3053698936 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 16[IKE] IKE_SA xarsa[1] established between 192.168.17.118[C=BG, O=MYVPN, CN=192.168.17.118]...192.168.17.137[C=BG, O=MYVPN, CN=ML]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 16[IKE] scheduling reauthentication in 3258s</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 16[IKE] maximum IKE_SA lifetime 3438s</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[ENC] unknown attribute type (28683)</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[ENC] parsed TRANSACTION request 2515032727 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[IKE] peer requested virtual IP %any</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[CFG] assigning new lease to 'mve'</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[IKE] assigning virtual IP 10.0.0.2 to peer 'mve'</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[ENC] generating TRANSACTION response 2515032727 [ HASH CP ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 01[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 03[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 03[ENC] parsed QUICK_MODE request 3999596799 [ HASH SA No ID ID ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 03[IKE] received 3600s lifetime, configured 1200s</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 03[ENC] generating QUICK_MODE response 3999596799 [ HASH SA No ID ID ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 03[NET] sending packet: from 192.168.17.118[500] to 192.168.17.137[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 11[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 11[ENC] parsed QUICK_MODE request 3999596799 [ HASH ]</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for __aes-aesni (__driver-aes-aesni)</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for __ecb-aes-aesni (__driver-ecb-aes-aesni)</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for __cbc-aes-aesni (__driver-cbc-aes-aesni)</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for __ecb-aes-aesni (cryptd(__driver-ecb-aes-aesni))</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: padlock: VIA PadLock not detected.</font></div><div><font size="1">Oct 27 03:31:04 ir1 charon: 11[IKE] CHILD_SA xarsa{1} established with SPIs ce0a9192_i 09fb746f_o and TS 0.0.0.0/0 === 10.0.0.2/32 </font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for __cbc-aes-aesni (cryptd(__driver-cbc-aes-aesni))</font></div><div><font size="1">Oct 27 03:31:04 ir1 kernel: alg: No test for authenc(hmac(sha1),cbc(aes)) (authenc(hmac(sha1-generic),cbc-aes-aesni))</font></div><div><font size="1">Oct 27 03:31:04 ir1 vpn: + C=BG, O=MYVPN, CN=ML 10.0.0.2/32 == 192.168.17.137 -- 192.168.17.118 == %any/0</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 16[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 16[ENC] parsed INFORMATIONAL_V1 request 2484179066 [ HASH D ]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 16[IKE] received DELETE for ESP CHILD_SA with SPI 09fb746f</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 16[IKE] closing CHILD_SA xarsa{1} with SPIs ce0a9192_i (0 bytes) 09fb746f_o (0 bytes) and TS 0.0.0.0/0 === 10.0.0.2/32 </font></div><div><font size="1">Oct 27 03:31:44 ir1 vpn: - C=BG, O=MYVPN, CN=ML 10.0.0.2/32 == 192.168.17.137 -- 192.168.17.118 == %any/0</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 02[NET] received packet: from 192.168.17.137[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 02[ENC] parsed INFORMATIONAL_V1 request 2470569940 [ HASH D ]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 02[IKE] received DELETE for IKE_SA xarsa[1]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 02[IKE] deleting IKE_SA xarsa[1] between 192.168.17.118[C=BG, O=MYVPN, CN=192.168.17.118]...192.168.17.137[C=BG, O=MYVPN, CN=ML]</font></div><div><font size="1">Oct 27 03:31:44 ir1 charon: 02[CFG] lease 10.0.0.2 by 'mve' went offline</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[NET] received packet: from 192.168.17.250[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[ENC] parsed ID_PROT request 0 [ SA V V V V V V V V V V V V V V ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received NAT-T (RFC 3947) vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-08 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-07 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-06 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-05 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-04 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-03 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-02 vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received draft-ietf-ipsec-nat-t-ike-02\n vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received XAuth vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received Cisco Unity vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[ENC] received unknown vendor ID: 40:48:b7:d5:6e:bc:e8:85:25:e7:de:7f:00:d6:c2:d3:80:00:00:00</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] received DPD vendor ID</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[IKE] 192.168.17.250 is initiating a Main Mode IKE_SA</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[ENC] generating ID_PROT response 0 [ SA V V V ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 01[NET] sending packet: from 192.168.17.118[500] to 192.168.17.250[500]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 03[NET] received packet: from 192.168.17.250[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 03[ENC] parsed ID_PROT request 0 [ KE No NAT-D NAT-D ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 03[IKE] sending cert request for "C=BG, O=MYVPN, CN=MYVPN CA"</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 03[ENC] generating ID_PROT response 0 [ KE No CERTREQ NAT-D NAT-D ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 03[NET] sending packet: from 192.168.17.118[500] to 192.168.17.250[500]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[NET] received packet: from 192.168.17.250[500] to 192.168.17.118[500]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[ENC] parsed ID_PROT request 0 [ ID CERT SIG CERTREQ N(INITIAL_CONTACT) ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[IKE] ignoring certificate request without data</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[IKE] received end entity cert "C=BG, O=MYVPN, CN=ML"</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[CFG] looking for XAuthInitRSA peer configs matching 192.168.17.118...192.168.17.250[ML]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[IKE] no peer config found</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[ENC] generating INFORMATIONAL_V1 request 3832895531 [ HASH N(AUTH_FAILED) ]</font></div><div><font size="1">Oct 27 03:31:58 ir1 charon: 11[NET] sending packet: from 192.168.17.118[500] to 192.168.17.250[500]</font></div></div><div><br></div><div>I searched the mailing list and I found that strongswan 5.x is supposed to work with Lion and ML I do know that my config is not matching Lion and ML clients? On other forums and I found <a href="https://discussions.apple.com/thread/4158642?start=15&tstart=0">some suggestions</a> also I tried to make the certificate smaller size according to some info in apple forums, but did not help either. </div><div><br></div><div>What I can see form the log is that Snow Leopard sends this:</div><div><div>14[CFG] looking for XAuthInitRSA peer configs matching 192.168.17.118…192.168.17.137<b>[C=BG, O=MYVPN, CN=ML]</b></div><div>14[CFG] <b>selected peer config "xarsa" ….</b></div></div><div>But breaking point is that Mountain Lion does not send that same message:</div><div><div>11[CFG] looking for XAuthInitRSA peer configs matching 192.168.17.118...192.168.17.250<b>[ML]</b></div><div>11[IKE] <b>no peer config found</b></div></div><div><br></div><div>According to apple documentation matching needs to be done based on <a href="http://help.apple.com/iosdeployment-vpn/mac/1.1/?lang=en-us#app36c960a6">client </a><a href="http://help.apple.com/iosdeployment-vpn/mac/1.1/?lang=en-us#app36c960a6">certificate name </a><a href="http://help.apple.com/iosdeployment-vpn/mac/1.1/?lang=en-us#app36c960a6">group name</a>? But I guess this is only for the new MacOS X versions Lion and ML and iOS6 because in Snow Leopard this is working fine…</div><div><i>"When using certificate-based authentication, make sure the server is set up to identify the user’s group based on fields in the client certificate."</i></div><div><br></div><div>I'm asking if someone can give me a hint is it possible that I can match users that use Lion and ML in my ipsec.conf based on client certificate <b>Common Name [ML]</b>?</div><div>I know this is not mature question but how can I assign multiply private IP address dynamically in one range let's say 10.0.0.0/24 to each client that connects? I can see the guide in wiki is only for single client, when I connect second user the first one is disconnected…</div><div><br></div><div>Kind regards,</div><div><br></div><div>Martin</div><div><br></div><div><br></div></body></html>