<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, Sans-Serif;font-size:12pt"><div><span>Thanks, looked into that... looks interesting.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; background-color: transparent; font-style: normal;"><span>Tried the delay at 50ms and was still getting it happening (Hard to tell if it's as often)... so then tried upping it to 100ms and it's still happening (Possibly less though)...</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida
Grande', sans-serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="background-color: transparent;">Apr 17 16:11:35 server-ip charon: 12[ENC] generating ID_PROT response 0 [ ID CERT SIG ]</div><div style="background-color: transparent;">Apr 17 16:11:35 server-ip charon: 12[NET] sending packet: from server.ip[4500] to client.ip[15042] (1484 bytes)</div><div style="background-color: transparent;">Apr 17 16:11:35 server-ip charon: 12[ENC] generating TRANSACTION request 1658042143 [ HASH CP ]</div><div style="background-color: transparent;">Apr 17 16:11:35 server-ip charon: 12[NET] sending packet: from server.ip[4500] to client.ip[15042] (76 bytes)</div><div style="background-color: transparent;">Apr 17 16:11:35 server-ip charon: 12[NET] using send delay: 100ms</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 11[IKE] sending retransmit 1 of request message ID 1658042143, seq
1</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 11[NET] sending packet: from server.ip[4500] to client.ip[15042] (76 bytes)</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 11[NET] using send delay: 100ms</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[NET] received packet: from client.ip[15042] to server.ip[4500] (92 bytes)</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[ENC] parsed TRANSACTION response 1658042143 [ HASH CP ]</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[IKE] XAuth authentication of '--hidden--' successful</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[ENC] generating TRANSACTION request 2065541666 [ HASH CP ]</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[NET] sending
packet: from server.ip[4500] to client.ip[15042] (76 bytes)</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 09[NET] using send delay: 100ms</div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 14[NET] received packet: from client.ip[15042] to server.ip[4500] (76 bytes)</div><div style="background-color: transparent;"><span></span></div><div style="background-color: transparent;">Apr 17 16:11:40 server-ip charon: 14[ENC] parsed TRANSACTION response 2065541666 [ HASH CP ]</div><div style="background-color: transparent;"><br></div><div style="background-color: transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;">Is there a way to cut out the xauth entirely and just rely on the certificates to auth? Would that speed it up and help?</div><div style="background-color:
transparent; color: rgb(0, 0, 0); font-size: 16px; font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-style: normal;"><br></div><div class="yahoo_quoted" style="display: block;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div style="font-family: HelveticaNeue, 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; font-size: 12pt;"> <div dir="ltr"> <font size="2" face="Arial"> On Thursday, 17 April 2014, 14:17, Martin Willi <martin@strongswan.org> wrote:<br> </font> </div> <div class="y_msg_container">Hi Harry,<br clear="none"><br clear="none">> Apr 17 12:38:22 server-ip charon: 12[ENC] generating ID_PROT response 0 [ ID CERT SIG ]<br clear="none">> Apr 17 12:38:22 server-ip charon: 12[NET] sending packet: from server.ip[4500] to remote.ip[16523] (1484 bytes)<br clear="none">> Apr 17 12:38:22
server-ip charon: 12[ENC] generating TRANSACTION request 2130590094 [ HASH CP ]<br clear="none">> Apr 17 12:38:22 server-ip charon: 12[NET] sending packet: from server.ip[4500] to remote.ip[16523] (76 bytes)<br clear="none">> <br clear="none">> [THIS IS WHERE THE DELAY HAPPENS]<br clear="none"><br clear="none">Likely that the smaller TRANSACTION request arrives before the ID_PROT<br clear="none">response of Main Mode, but your (raccoon) iOS client can't handle it and<br clear="none">waits for the retransmit.<br clear="none"><br clear="none">Have a look at the discussion and the work-around suggested at [1], this<br clear="none">might work here as well.<br clear="none"><br clear="none">Regards<br clear="none">Martin<div class="yqt4511528682" id="yqtfd87593"><br clear="none"><br clear="none">[1]</div><a shape="rect" href="https://lists.strongswan.org/pipermail/users/2014-April/005961.html"
target="_blank">https://lists.strongswan.org/pipermail/users/2014-April/005961.html</a><div class="yqt4511528682" id="yqtfd91377"><br clear="none"><br clear="none"><br clear="none"></div><br><br></div> </div> </div> </div> </div></body></html>