<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"></head><body >AARGH -I knew it was somethin simple... sometimes you don't see the obvious... thank you for your hint! <div>Jc</div><br>Martin Willi <martin@strongswan.org> hat geschrieben:<br><br><br><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=utf-8">
<META NAME="Generator" CONTENT="Zarafa HTML builder 1.0">
<TITLE></TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT STYLE="font-family: courier" SIZE=2>
Hi Jakob,<br>
<br>
> 08[CFG] looking for pre-shared key peer configs matching 172.17.123.1...a.b.c.d[remote-id]<br>
> 08[CFG] candidate "client-test", match: 1/20/3100 (me/other/ike)<br>
> 08[IKE] no peer config found<br>
<br>
> So it is looking for a PSK using the internal address although I<br>
> configured a local ID !?<br>
<br>
The daemon is not looking for a PSK, but a configuration using PSK<br>
authentication it can use for that client. The lookup is for the local<br>
IP address, the remote IP address and the remote Identity received over<br>
IKE.<br>
<br>
A match for that selector is found, but the configuration is not usable,<br>
because it does not allow PSK authentication. The default is public key<br>
authentication. Use authby=psk (or the never leftauth/rightauth options)<br>
to allow PSK authentication on that configuration. man ipsec.conf for<br>
details.<br>
<br>
I agree that the log is not very clear in what is wrong here, I'll see<br>
if we can improve that.<br>
<br>
Regards<br>
Martin<br>
</FONT>
</P>
</BODY></HTML>