<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi,<br class=""><br class="">I’m just starting out with StrongSwan and I just can’t get my iPhone to connect, I hope someone can help me.<br class=""><br class="">First of all, here are my configs:<br class=""><br class=""><br class="">ipsec.secrets<br class=""><br class="">: RSA server-key.pem<br class=""><br class=""><br class=""><br class="">ipsec.conf<br class=""><br class="">config setup<br class=""> # strictcrlpolicy=yes<br class=""> # uniqueids = no<br class=""> charondebug="cfg 2, dmn 2, ike 2, net 2"<br class=""><br class="">conn %default<br class=""> keyexchange=ikev2<br class=""> esp=aes-aes256-sha-modp1024,aes256-sha512-modp4096<br class=""> ike=aes-aes256-sha-modp1024,aes256-sha512-modp4096<br class=""><br class="">conn home<br class=""> mobike=yes<br class=""> left=%any<br class=""> leftid=<a href="http://server.example.com" class="">server.example.com</a><br class=""> leftauth=pubkey<br class=""> leftcert=server-cert.pem<br class=""> leftsendcert=always<br class=""> leftsubnet=0.0.0.0/0,::/0<br class=""> leftfirewall=yes<br class=""> right=%any<br class=""> rightid=<a href="http://server.example.com" class="">server.example.com</a><br class=""># rightsourceip=%dhcp<br class=""> rightauth=pubkey<br class=""> rightcert=client-cert.pem<br class=""> rightauth2=eap-mschapv2<br class=""> auto=add<br class=""><br class=""><br class=""><br class="">strongswan.conf<br class=""><br class="">charon {<br class=""><br class=""> threads = 16<br class=""><br class=""> dns1 = 10.0.0.1<br class=""> nbns1 = 10.0.0.1<br class=""><br class=""> load_modular = yes<br class=""><br class=""> plugins {<br class=""> include strongswan.d/charon/*.conf<br class=""><br class=""> dhcp {<br class=""> server = 10.0.0.1<br class=""> }<br class=""> }<br class=""><br class="">}<br class=""><br class=""><br class="">On my iPhone, I set the Remote ID to <a href="http://server.example.com" class="">server.example.com</a>.<br class=""><br class=""><br class="">This is the log output, when I try to connect:<br class=""><br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 03[NET] received packet: from 212.95.7.23[41484] to 210.33.47.77[500]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 03[NET] waiting for data on sockets<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[NET] received packet: from 212.95.7.23[41484] to 210.33.47.77[500] (388 bytes)<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] looking for an ike config for 210.33.47.77...212.95.7.23<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] candidate: %any...%any, prio 28<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] found matching ike config: %any...%any with prio 28<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[IKE] 212.95.7.23 is initiating an IKE_SA<br class="">Fri Feb 5 15:51:33 2016 <a href="http://authpriv.info" class="">authpriv.info</a> : 14[IKE] 212.95.7.23 is initiating an IKE_SA<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[IKE] IKE_SA (unnamed)[2] state change: CREATED => CONNECTING<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] selecting proposal:<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] proposal matches<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] received proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] configured proposals: IKE:AES_CBC_128/AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:AES_CBC_256/HMAC_SHA2_512_256/PRF_HMAC_SHA2_512/MODP_4096, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/AES_CTR_128/AES_CTR_192/AES_CTR_256/CAMELLIA_CTR_128/CAMELLIA_CTR_192/CAMELLIA_CTR_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/HMAC_MD5_96/HMAC_SHA1_96/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/PRF_HMAC_MD5/PRF_HMAC_SHA1/PRF_HMACFri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[CFG] selected proposal: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[IKE] remote host is behind NAT<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[IKE] sending cert request for "C=AT, O=Organisation, CN=<a href="http://server.example.com" class="">server.example.com</a> (Root CA)"<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 14[NET] sending packet: from 210.33.47.77[500] to 212.95.7.23[41484] (337 bytes)<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 01[NET] sending packet: from 210.33.47.77[500] to 212.95.7.23[41484]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 03[NET] received packet: from 212.95.7.23[41122] to 210.33.47.77[4500]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 03[NET] waiting for data on sockets<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[NET] received packet: from 212.95.7.23[41122] to 210.33.47.77[4500] (428 bytes)<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[CFG] looking for peer configs matching 210.33.47.77[<a href="http://server.example.com" class="">server.example.com</a>]...212.95.7.23[10.2.219.224]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[CFG] no matching peer config found<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP4_ADDRESS attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP4_DHCP attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP4_DNS attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP4_NETMASK attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP6_ADDRESS attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP6_DHCP attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] processing INTERNAL_IP6_DNS attribute<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] peer supports MOBIKE<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[NET] sending packet: from 210.33.47.77[4500] to 212.95.7.23[41122] (76 bytes)<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 13[IKE] IKE_SA (unnamed)[2] state change: CONNECTING => DESTROYING<br class="">Fri Feb 5 15:51:33 2016 <a href="http://daemon.info" class="">daemon.info</a> : 01[NET] sending packet: from 210.33.47.77[4500] to 212.95.7.23[41122]<br class=""><br class=""><div class=""><br class=""></div><div class=""><br class=""></div><div class="">I have read every "no matching peer“ post on this mailing list, but haven’t found a solution that worked for me.</div><div class=""><br class=""></div><div class="">Best wishes,</div><div class="">Markus</div></body></html>