<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">I know the leftid parameter relates to certificates, which I am not using, but does it also relate to sending the right identity to the remote router? I assumed so based on this passage in the docs:</div><div class=""><br class=""></div><blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class=""><div class=""><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 10.800000190734863px; background-color: rgb(255, 255, 255);" class="">how the </span><em style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 10.800000190734863px;" class="">left|right</em><span style="color: rgb(54, 0, 12); font-family: Verdana, sans-serif; font-size: 10.800000190734863px; background-color: rgb(255, 255, 255);" class=""> participant should be identified for authentication;</span></div></blockquote><div class=""><br class=""></div><div class="">But after re-reading, it seems to just be for identifying the cert.</div><div class=""><br class=""></div><div class="">If I am reading your reply correctly, it seems you are getting this to work by not using an elastic IP, but just the public IP of your instance. Then using a script to update it as needed. Maybe that’s the only way…</div><div class=""><br class=""></div><div class="">I will try removing the elastic IP and seeing if the instance is aware of it’s own public IP, i.e.; by looking in ifconfig. Because the elastic IP certainly does not show up there.</div><div class=""><br class=""></div><div class="">- Matt</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On Nov 16, 2016, at 7:40 AM, Turbo Fredriksson <<a href="mailto:turbo@bayour.com" class="">turbo@bayour.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 16 Nov 2016, at 05:27, Mathew Marulla <<a href="mailto:matt_m@me.com" class="">matt_m@me.com</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Although I have read just about every tutorial and similar posting I can find about running StrongSwan on an EC2 instance, I still can not seem to get it to work.<br class=""></blockquote><br class="">I’m doing the same thing, but I started “from scratch” (didn’t have any existing<br class="">setup so this is the first setup).<br class=""><br class="">My ipsec.conf:<br class=""><br class="">—— s n i p ——<br class="">config setup<br class=""> uniqueids=no<br class=""> strictcrlpolicy=no<br class=""><br class=""># NOTE: The 'leftid' must be present as a "Subject Alternative Name" in the cert!!<br class="">conn %default<br class=""> left=%ETH0%<br class=""> leftid=vpn.domain.tld<br class=""> leftcert=hostname.pem<br class=""> leftsubnet=<VPC_CIDR><br class=""> leftfirewall=yes<br class=""> leftsendcert=always<br class=""> leftdns=%DNS%<br class=""><br class=""> rightdns=%DNS%<br class=""><br class=""> keyexchange=ikev2<br class=""> dpdaction=clear<br class=""> dpddelay=2400s<br class=""> fragmentation=yes<br class=""> forceencaps=yes<br class=""> compress=yes<br class=""><br class="">ca domain<br class=""> cacert=domain.tld.pem<br class=""> auto=add<br class=""><br class="">conn client<br class=""> leftsourceip=%ETH0%<br class=""><br class=""> right=%any<br class=""> rightid=%any<br class=""> rightsourceip=<VPN_CIDR><br class=""> rightauth=eap-mschapv2<br class=""><br class=""> eap_identity=%identity<br class=""> type=tunnel<br class=""> auto=add<br class="">—— s n i p ——<br class=""><br class="">%ETH0% and %DNS% is changed by a script at boot (by first finding the IP of<br class="">‘eth0’ and the ’nameserver’ entry in resolv.conf) because EC2 instances use DHCP.<br class="">So I’m not coding any ‘external’ IP (EIP), just the ‘internal’ (DHCP/private) one..<br class=""><br class="">I’m not, currently, using any (ELB) load balancers in front of StrongSWAN, but<br class="">I might do that in the future. Maybe.<br class=""><br class=""><br class="">I can authenticate and setup the route etc - I can access the ‘internal’ IP via the<br class="">VPN just fine.<br class=""><br class="">I have yet to get access to the other VPCs over the VPN. I can access them<br class="">if I first ssh into the VPN server and then ssh to a host in another VPC.<br class=""><br class="">This is done with VPC peering, but I had _assumed_ that that would work<br class="">for VPN as well. But it’s not..<br class=""><br class="">I can’t access any other instance in the VPN VPC though.<br class=""><br class="">I’m pretty sure that have something to do with the routing table(s), but I haven’t<br class="">had time to look into this. I’m pretty sure the StrongSWAN setup is working<br class="">correctly though, I’m using the exact same setup at home and there everything<br class="">work just fine.</div></div></blockquote></div><br class=""></body></html>