<div dir="ltr">1.) Do you need to stay on 4.5.2? As per my understanding, it is quite old. The latest version is 5.3.0.<div>2.) Do you have multiple tunnels on this unit with different authentication methods? The examples at <a href="https://www.strongswan.org/uml/testresults4/ikev1/rw-psk-ipv4/">https://www.strongswan.org/uml/testresults4/ikev1/rw-psk-ipv4/</a> show authby in the default connection.</div><div><br></div><div>Regards,</div><div>Randy</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 10:07 AM, Alexandre DEPREZ <span dir="ltr"><<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi Randy,<div><br></div><div>I forgot to mention, i'm using this version: </div><div><br></div><div>Linux strongSwan U4.5.2/K3.2.0-4-amd64</div><div><br></div><div>Here is it :<br></div><div><br></div><div><div>conn tunnel-1</div><div> left=a.a.a.a</div><div> right=b.b.b.b</div><div> leftsubnet=<a href="http://10.252.243.128/28" target="_blank">10.252.243.128/28</a></div><div> rightsubnet=<a href="http://172.23.149.0/24" target="_blank">172.23.149.0/24</a></div><div> leftsourceip=a.a.a.a</div><div> ike=aes256-sha1-modp1024,aes128-sha1-modp1024!</div><div> ikelifetime=86400s</div><div> dpddelay=15s</div><div> dpdtimeout=30s</div><div> dpdaction=restart</div><div> esp=aes256-sha1!</div><div> keylife=3600s</div><div> rekeymargin=540s</div><div> type=tunnel</div><div> authby=secret</div><div> pfs=no</div><div> compress=no</div><div> auto=start</div><div> keyingtries=%forever</div></div><div><br></div><div>I also tried to use </div><div><br></div><div><div> leftxauthclient=no</div><div> rightxauthserver=no</div></div><div><br></div><div>No changes.</div><div><br></div><div>Thanks</div><div><br></div><div><br></div><div><br></div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jun 5, 2015 at 7:02 PM, Randy Wyatt <span dir="ltr"><<a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Please send a sanitized version of your configuration. xauth should only be sent if you configured it to be sent.</div><div class="gmail_extra"><br><div class="gmail_quote"><div><div>On Fri, Jun 5, 2015 at 9:09 AM, Alexandre DEPREZ <span dir="ltr"><<a href="mailto:alex@madrouter.com" target="_blank">alex@madrouter.com</a>></span> wrote:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div><div dir="ltr">Hi,<div><br></div><div>I'm using strongswan only for L2L VPN. </div><div><br></div><div>It's been some times now, I can not be the initiator of the VPN because strongswan is always sending an XAUTH option in the phase 1 establishment. </div><div><br></div><div>When the other side is not configured to receive remote user, it's working but when it is, I'm receiving L2TP/IPsec or some other remote access vpn protocols.</div><div><br></div><div>I can not wait for the other side to send me trafic in order to be the responder. I tried to recompile strongswan removing xauth, but it's not working.</div><div><br></div><div>Is there any configuration command I can use to force strongswan not to send XAUTH ?</div><div><br></div><div>Thanks</div><div><br></div><div>Alex</div><div><br></div><div><br></div><div><br></div><div><br></div><div> </div></div>
<br></div></div>_______________________________________________<br>
Users mailing list<br>
<a href="mailto:Users@lists.strongswan.org" target="_blank">Users@lists.strongswan.org</a><br>
<a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><span><font color="#888888"><br></font></span></blockquote></div><span><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>Randy W. Wyatt</div><div><a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a></div><div>Home: <a href="tel:858-309-5303" value="+18583095303" target="_blank">858-309-5303</a></div><div>Cell: <a href="tel:858-598-4421" value="+18585984421" target="_blank">858-598-4421</a></div><div>Fax: <a href="tel:858-408-7554" value="+18584087554" target="_blank">858-408-7554</a><table width="93%" align="center" style="background-color:rgb(242,245,247)" border="0" cellspacing="0" cellpadding="4"><tbody><tr><td valign="top" style="width:169px;line-height:155%"><font color="#000000" face="Verdana, Arial" style="font-size:11px;margin-top:4px" valign="top"><b></b></font></td><td valign="top"><span style="color:rgb(0,51,102);font-size:18px;font-weight:bold"><font color="#1155cc"><br></font></span></td></tr></tbody></table></div></div></div></div></div></div></div>
</font></span></div>
</blockquote></div><br></div>
</div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>Randy W. Wyatt</div><div><a href="mailto:rwwyatt01@gmail.com" target="_blank">rwwyatt01@gmail.com</a></div><div>Home: 858-309-5303</div><div>Cell: 858-598-4421</div><div>Fax: 858-408-7554<table width="93%" align="center" style="background-color:rgb(242,245,247)" border="0" cellspacing="0" cellpadding="4"><tbody><tr><td valign="top" style="width:169px;line-height:155%"><font color="#000000" face="Verdana, Arial" style="font-size:11px;margin-top:4px" valign="top"><b></b></font></td><td valign="top"><span style="color:rgb(0,51,102);font-size:18px;font-weight:bold"><font color="#1155cc"><br></font></span></td></tr></tbody></table></div></div></div></div></div></div></div>
</div>