<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi, I have a strongswan 5.3.5 on Ubuntu server. I use this VPN server to iOS devices and Windows 10 laptops.<br class=""><br class="">I will try to explain the problem:<br class=""><br class="">I have ipsec.secrets with user/password EAP auth ex: <br class=""><br class=""><blockquote type="cite" class=""># This file holds shared secrets or RSA private keys for authentication.<br class=""><br class=""># This is private key located at /etc/ipsec.d/private/<br class="">: RSA privkey.pem<br class=""><br class=""># VPN users<br class="">strike : EAP "12341234"<br class="">dottas : EAP "45645645"</blockquote><div class=""><br class="">I have my ipsec.conf assign static ip config to users based on rightid:</div><div class=""><br class=""></div><div class=""><blockquote type="cite" class=""><div class="">config setup</div><div class=""> charondebug = ike 3, cfg 3</div><div class=""><br class=""></div><div class="">conn %default</div><div class=""><br class=""></div><div class=""> dpdaction=clear</div><div class=""> dpddelay=550s</div><div class=""> dpdtimeout=72000s</div><div class=""> keyexchange=ikev2</div><div class=""> auto=add</div><div class=""> rekey=no</div><div class=""> reauth=no</div><div class=""> fragmentation=yes</div><div class=""> compress=yes</div><div class=""><br class=""></div><div class=""> # left - local (server) side</div><div class=""> leftcert=fullchain.pem<span class="Apple-tab-span" style="white-space:pre"> </span># Filename of certificate located at /etc/ipsec.d/certs/</div><div class=""> leftsendcert=always</div><div class=""> # Routes pushed to clients. If you don't have ipv6 then remove ::/0</div><div class=""> leftsubnet=0.0.0.0/0</div><div class=""><br class=""></div><div class=""> # right - remote (client) side</div><div class=""> eap_identity=%identity</div><div class=""> # ipv4 subnets that assigns to clients.</div><div class=""> rightsourceip=10.8.0.0/24</div><div class=""> rightdns=8.8.8.8</div><div class=""><br class=""></div><div class=""># Windows Auth CFG</div><div class="">conn ikev2-mschapv2</div><div class=""> rightauth=eap-mschapv2</div><div class=""><br class=""></div><div class=""># Apple Auth CFG</div><div class="">conn ikev2-mschapv2-apple</div><div class=""> rightauth=eap-mschapv2</div><div class=""> leftid=<a href="http://mydomain.com" class="">mydomain.com</a></div><div class=""><br class=""></div><div class=""># Static IP configs</div><div class=""><br class=""></div><div class="">conn static-ip-for-strike</div><div class=""> also="ikev2-mschapv2-apple"</div><div class=""> right=%any</div><div class=""> rightid=strike</div><div class=""> rightsourceip=10.8.0.100/32</div><div class=""> auto=add</div><div class=""><br class=""></div><div class="">conn static-ip-for-dottas</div><div class=""> also="ikev2-mschapv2"</div><div class=""> right=%any</div><div class=""> rightid=dottas</div><div class=""> rightsourceip=10.8.0.33/32</div><div class=""> auto=add</div></blockquote></div><div class=""><div class=""><br class=""></div></div><div class="">All iOS clients connect fine and take static IP but Windows always get an IP address by DHCP pool. If I delete rightsourceip=10.8.0.0/24 field Windows dont recibe any IP address and dont connect.</div><div class=""><br class=""></div><div class="">Some log outputs:</div><div class=""><br class=""></div><div class="">ipsec leases</div><div class=""><br class=""></div><blockquote type="cite" class=""><div class=""><br class=""></div><div class="">Leases in pool '10.8.0.0/24', usage: 0/254, 0 online<br class=""> no matching leases found<br class="">Leases in pool '10.8.0.33/32', usage: 0/1, 0 online<br class=""> no matching leases found<br class="">Leases in pool '10.8.0.100/32', usage: 0/1, 0 online<br class=""> no matching leases found</div><div class="">...</div></blockquote><div class=""><br class=""></div><div class="">journalctl -f -u strongswan</div><div class=""><br class=""></div><div class=""></div><blockquote type="cite" class=""><div class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] IKE_SA ikev2-mschapv2[1] state change: CONNECTING => ESTABLISHED<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] peer requested virtual IP %any<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] assigning new lease to 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] assigning virtual IP 10.8.0.1 to peer 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] peer requested virtual IP %any6<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] no virtual IP found for %any6 requested by 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] building INTERNAL_IP4_DNS attribute<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] looking for a child config for 0.0.0.0/0 ::/0 === 0.0.0.0/0 ::/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposing traffic selectors for us:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] 0.0.0.0/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposing traffic selectors for other:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] candidate "ikev2-mschapv2" with prio 10+2<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] found matching child config "ikev2-mschapv2" with prio 12<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposal matches<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting traffic selectors for us:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 0.0.0.0/0, received: 0.0.0.0/0 => match: 0.0.0.0/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 0.0.0.0/0, received: ::/0 => no match<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting traffic selectors for other:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 10.8.0.1/32, received: 0.0.0.0/0 => match: 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 10.8.0.1/32, received: ::/0 => no match<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] CHILD_SA ikev2-mschapv2{1} established with SPIs ccd1079d_i 9a38f558_o and TS 0.0.0.0/0 === 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] CHILD_SA ikev2-mschapv2{1} established with SPIs ccd1079d_i 9a38f558_o and TS 0.0.0.0/0 === 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) ]</div>...</blockquote><div class=""><br class=""></div><div class=""><div class="">ipsec leases</div><div class=""><br class=""></div><blockquote type="cite" class=""><div class="">Leases in pool '10.8.0.0/24', usage: 1/254, 0 online</div></blockquote><blockquote type="cite" class=""><font color="#5856d6" class=""> 10.8.0.1 online 'dottas'</font></blockquote><blockquote type="cite" class=""><div class="">Leases in pool '10.8.0.33/32', usage: 0/1, 0 online<br class=""> no matching leases found<br class="">Leases in pool '10.8.0.100/32', usage: 0/1, 0 online<br class=""> no matching leases found</div><div class="">...</div></blockquote><div class=""><div class=""><br class=""></div></div><div class=""><br class=""></div><div class="">Any idea to assign static ip address to windows clients?</div><div class=""><br class=""></div><div class="">Thank you.</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div></div></body></html>