<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><br><br>Hi,<div><br></div><div>I have a very simple ikev2 connection block. Sample below:</div><div>I can connect and browse http/https fine. But if I try to use a web socket, the connection fails.</div><div><br></div><div>Sample url that fails to even load the page</div><div><a href="http://www.websocket.org/echo.html" target="_blank">http://www.websocket.org/echo.html</a></div><div><br></div><div>Is there something I need to setup to get web sockets working correctly?</div><div><br></div><div><br></div><div><div>config setup</div><div> charondebug="dmn 1, mgr 1, ike 1, chd 1, job 1, cfg 1, knl 1, net 1, asn 1, enc 1, lib 1, esp 1, tls 1"</div><div> #plutodebug=all</div><div> # crlcheckinterval=600</div><div> strictcrlpolicy=no</div><div> # cachecrls=yes</div><div> # charondebug=4</div><div> nat_traversal=yes</div><div> #charonstart=no</div><div> #plutostart=no</div><div><br></div><div>ca servers</div><div> auto=add</div><div><br></div><div>conn %default</div><div> ikelifetime=60m</div><div> keylife=20m</div><div> rekeymargin=3m</div><div> keyingtries=1</div><div> keyexchange=ikev1</div><div> auto=add</div><div><br></div><div><br></div><div>conn iphone-ios8-ike-v2</div><div> ike=aes256-sha256-modp2048,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024! # Win7 is aes256, sha-1, modp1024; iOS is aes256, sha-256, modp1024; OS X is 3DES, sha-1, modp1024</div><div> esp=aes256-sha256-modp2048,aes256-sha256,aes256-sha1,3des-sha1! # Win 7 is aes256-sha1, iOS is aes256-sha256, OS X is 3des-shal1</div><div> keyexchange=ikev2</div><div> rightauth=pubkey</div><div> left=%defaultroute</div><div> leftid=@*.example.com</div><div> leftsubnet=0.0.0.0/0</div><div> leftfirewall=no</div><div> leftcert=example.pem</div><div> leftsendcert=always</div><div> leftupdown=/usr/local/example/bin/up_down/se_updown</div><div> right=%any</div><div> # !!!do not specify rightsubnet!!!</div><div> #rightsubnet=10.252.0.0/16</div><div> rightsourceip=10.252.0.0/16</div><div> rightsendcert=always</div><div> # Require all subject fields to be matched by star</div><div> # As well as CA's pull in</div><div> #rightid="C=US, ST=*, L=*, O=*, CN=*"</div><div> eap_identity=%any</div><div> fragmentation=yes</div><div> auto=add</div><div><br></div><br><hr style="width:100%;height:2px;"><br><br><br>Joshua J. Gross<br></div> </div></body>
</html>