<div dir="ltr">Good afternoon,<div><br></div><div>I have two strongSwan VPN Servers running; one to keep me connected to the United Kingdom and one to protect data on hotel WiFi (etc.) in the United States. Admittedly, I am not familiar with strongSwan; having not heard about it until several days ago. In either case, I was successful in configuring and installing strongSwan on two servers: an endpoint in SFO and an endpoint in London.</div><div><br></div><div>I have been successful at connecting Windows 10 Pro clients to the VPN but my OS X 10.11.5 and iOS 10 clients have been giving me issues when attempting to connect.</div><div><br></div><div>Per the following resources:</div><div><br></div><div><a href="https://wiki.strongswan.org/projects/strongswan/wiki/AppleClients">https://wiki.strongswan.org/projects/strongswan/wiki/AppleClients</a><br></div><div><a href="https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html">https://raymii.org/s/tutorials/IPSEC_vpn_with_Ubuntu_16.04.html</a><br></div><div><a href="https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/">https://www.zeitgeist.se/2013/11/22/strongswan-howto-create-your-own-vpn/</a><br></div><div><br></div><div>I have generated the required certificates; enabled multi-device usage from a single certificate; and was successful in creating both VPN Connections for Windows 10 Pro.</div><div><br></div><div>For OS X, I have been successful in establishing the connection to the VPN by using the Apple Configurator 2 app to create a VPN Configuration profile that specified the p12 bundle and set the IKEv2 authentication mode to use DH Group 2 with 3DES and SHA1-96. OS X presents the most interesting prediciment: it connects, gets an IP address, and adds the default routes (netstat -rn included below) but it doesn't send any data across the tunnel:</div><div><br></div><div><pre style="margin-top:0px;margin-bottom:1em;padding:5px;border:0px;font-size:13px;width:auto;max-height:600px;overflow:auto;font-family:consolas,menlo,monaco,"lucida console","liberation mono","dejavu sans mono","bitstream vera sans mono","courier new",monospace,sans-serif;background-color:rgb(239,240,241);word-wrap:normal;color:rgb(36,39,41)"><code style="margin:0px;padding:0px;border:0px;font-family:consolas,menlo,monaco,"lucida console","liberation mono","dejavu sans mono","bitstream vera sans mono","courier new",monospace,sans-serif;white-space:inherit"> Internet:
Destination Gateway Flags Refs Use Netif Expire
default 10.0.0.1 UGSc 43 0 en1
default link#8 UCSI 0 0 ipsec0
10/16 link#5 UCS 8 0 en1
<a href="http://10.0.0.1/32">10.0.0.1/32</a> link#5 UCS 1 0 en1
10.0.0.1 <EDGE ROUTER MAC> UHLWIir 47 194 en1 1076
<a href="http://10.0.143.243/32">10.0.143.243/32</a> link#5 UCS 1 0 en1
10.0.143.243 <MBP MAC ADDRESS> UHLWI 0 1 lo0
45.32.180.111 10.0.0.1 UGHS 0 0 en1
127 127.0.0.1 UCS 0 0 lo0
127.0.0.1 127.0.0.1 UH 18 781055 lo0
169.254 link#5 UCS 0 0 en1
172.11.22.1 172.11.22.1 UH 0 0 ipsec0
224.0.0 link#5 UmCS 1 0 en1
224.0.0 link#8 UmCSI 0 0 ipsec0
224.0.0.251 1:0:5e:0:0:fb UHmLWI 0 0 en1
<a href="http://255.255.255.255/32">255.255.255.255/32</a> link#5 UCS 0 0 en1
<a href="http://255.255.255.255/32">255.255.255.255/32</a> link#8 UCSI 0 0 ipsec0</code></pre></div><div> As you can see, link#8 is the IPSec route and 45.x.x.x is the VPN server while <a href="http://172.11.22.1/24">172.11.22.1/24</a> is the private address space.</div><div><br></div><div>To further detail, this is the configuration for the UK VPN Endpoint corresponding to the information above:</div><div><pre style="margin-top:0px;margin-bottom:1em;padding:5px;border:0px;font-size:13px;width:auto;max-height:600px;overflow:auto;font-family:consolas,menlo,monaco,"lucida console","liberation mono","dejavu sans mono","bitstream vera sans mono","courier new",monospace,sans-serif;background-color:rgb(239,240,241);word-wrap:normal;color:rgb(36,39,41)"><code style="margin:0px;padding:0px;border:0px;font-family:consolas,menlo,monaco,"lucida console","liberation mono","dejavu sans mono","bitstream vera sans mono","courier new",monospace,sans-serif;white-space:inherit"># ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="ike 2, knl 2, cfg 2, net 2, esp 2, dmn 2, mgr 2"
conn %default
keyexchange=ikev2
ike=aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes256-aes128-sha256-sha1-modp2048-modp4096-modp1024,aes256-sha1-modp1024,aes256-sha256-modp1024,aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha256-modp4096,aes256-sha384-ecp384,aes256-sha384-modp1024,aes256-sha384-modp1536,aes256-sha384-modp2048,aes256-sha384-modp4096,aes256gcm16-aes256gcm12-aes128gcm16-aes128gcm12-sha256-sha1-modp2048-modp4096-modp1024,3des-sha1-modp1024!
esp=aes128-aes256-sha1-sha256-modp2048-modp4096-modp1024,aes128-sha1,aes128-sha1-modp1024,aes128-sha1-modp1536,aes128-sha1-modp2048,aes128-sha256,aes128-sha256-ecp256,aes128-sha256-modp1024,aes128-sha256-modp1536,aes128-sha256-modp2048,aes128gcm12-aes128gcm16-aes256gcm12-aes256gcm16-modp2048-modp4096-modp1024,aes128gcm16,aes128gcm16-ecp256,aes256-sha1,aes256-sha256,aes256-sha256-modp1024,aes256-sha256-modp1536,aes256-sha256-modp2048,aes256-sha256-modp4096,aes256-sha384,aes256-sha384-ecp384,aes256-sha384-modp1024,aes256-sha384-modp1536,aes256-sha384-modp2048,aes256-sha384-modp4096,aes256gcm16,aes256gcm16-ecp384,3des-sha1!
dpdaction=clear
dpddelay=300s
authby=pubkey
left=%any
leftid=<a href="http://claraoswald.bbr01.lon.uk.ini.arendellenet.net">claraoswald.bbr01.lon.uk.ini.arendellenet.net</a>
leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a>
leftcert=vpnHostCert.der
leftsendcert=always
right=%any
rightsourceip=<a href="http://172.11.22.0/24,2002:25f7:7489:3::/112">172.11.22.0/24,2002:25f7:7489:3::/112</a>
rightdns=8.8.8.8,2001:4860:4860::8888
conn IPSec-IKEv2
keyexchange=ikev2
auto=add</code></pre></div><div>With the server configuration spelled out, the second most interesting thing is that the certificate which works to connect OS X to the VPN (although it doesn't send traffic over the VPN) does not work at all on iOS 10. iOS 10 simply starts the "Connecting" process and immediately terminates back to "Disconnected."</div><div><br></div><div>How can I get the VPN to work as it does in Windows 10 Pro? OS X establishes the link but won't send anything through the tunnel while iOS won't connect at all - even with an Apple Configurator 2 Profile: the very same one used by OS X.</div><div><br></div><div>The UK deployment is permanent while the US deployment is temporary and thus why I provided the UK deployment. However, the US deployment is very similarly setup and experiences the same issues.</div><div><br></div><div>I have circled around Google and the Wiki for days; now I can just use a little user support feedback to get this deployment complete.</div><div><br></div><div>Thank You,</div><div>Avalon Thorne</div></div>