<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi, i have uploaded my logs with your considerations (without sql database) when strongswan starts and example of ios device connection and windows device error connection.<div class=""><br class=""></div><div class=""><div class="">strongswan_log_load.log -> <a href="https://paste.ee/p/GBEJ7" class="">https://paste.ee/p/GBEJ7</a></div><div class="">working_ios_connection.log -> <a href="https://paste.ee/p/cibrx" class="">https://paste.ee/p/cibrx</a><br class=""><div class="">windows_cant_connnect.log -> <a href="https://paste.ee/p/AnTsJ" class="">https://paste.ee/p/AnTsJ</a></div><div class=""><br class=""></div><div class="">Thaks for your help.</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">El 8 mar 2017, a las 14:22, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" class="">noel@familie-kuntze.de</a>> escribió:</div><br class="Apple-interchange-newline"><div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Logs, please.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">On 08.03.2017 08:49, Daniel wrote:</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class="">I made the change (auto=add) and it still does not work. I'm going to try integrating pools into sqlite and tell them the result.<br class=""><br class="">Thank you<br class=""><br class=""><blockquote type="cite" class="">El 8 mar 2017, a las 0:32, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de" class="">noel@familie-kuntze.de</a><span class="Apple-converted-space"> </span><<a href="mailto:noel@familie-kuntze.de" class="">mailto:noel@familie-kuntze.de</a>>> escribió:<br class=""><br class="">Move the "auto=add" out of conn %default into each individual conn you actually need.<br class="">The way you're doing it makesno sense.<br class="">The proper way to do this is to use a static IP pool backed by an sqlite file or a MySQL server<br class="">and to assign the leases based on the identity there.<br class=""><br class="">The proper way to do this is to<span class="Apple-converted-space"> </span><br class="">On 07.03.2017 21:56, Daniel wrote:<br class=""><blockquote type="cite" class="">Hi, I have a strongswan 5.3.5 on Ubuntu server. I use this VPN server to iOS devices and Windows 10 laptops.<br class=""><br class="">I will try to explain the problem:<br class=""><br class="">I have ipsec.secrets with user/password EAP auth ex:<span class="Apple-converted-space"> </span><br class=""><br class=""><blockquote type="cite" class=""># This file holds shared secrets or RSA private keys for authentication.<br class=""><br class=""># This is private key located at /etc/ipsec.d/private/<br class="">: RSA privkey.pem<br class=""><br class=""># VPN users<br class="">strike : EAP "12341234"<br class="">dottas : EAP "45645645"<br class=""></blockquote><br class="">I have my ipsec.conf assign static ip config to users based on rightid:<br class=""><br class=""><blockquote type="cite" class="">config setup<br class=""> charondebug = ike 3, cfg 3<br class=""><br class="">conn %default<br class=""><br class=""> dpdaction=clear<br class=""> dpddelay=550s<br class=""> dpdtimeout=72000s<br class=""> keyexchange=ikev2<br class=""> auto=add<br class=""> rekey=no<br class=""> reauth=no<br class=""> fragmentation=yes<br class=""> compress=yes<br class=""><br class=""> # left - local (server) side<br class=""> leftcert=fullchain.pem# Filename of certificate located at /etc/ipsec.d/certs/<br class=""> leftsendcert=always<br class=""> # Routes pushed to clients. If you don't have ipv6 then remove ::/0<br class=""> leftsubnet=0.0.0.0/0<br class=""><br class=""> # right - remote (client) side<br class=""> eap_identity=%identity<br class=""> # ipv4 subnets that assigns to clients.<br class=""> rightsourceip=10.8.0.0/24<br class=""> rightdns=8.8.8.8<br class=""><br class=""># Windows Auth CFG<br class="">conn ikev2-mschapv2<br class=""> rightauth=eap-mschapv2<br class=""><br class=""># Apple Auth CFG<br class="">conn ikev2-mschapv2-apple<br class=""> rightauth=eap-mschapv2<br class=""> leftid=<a href="http://mydomain.com/" class="">mydomain.com</a><span class="Apple-converted-space"> </span><<a href="http://mydomain.com/" class="">http://mydomain.com/</a>> <<a href="http://mydomain.com/" class="">http://mydomain.com</a><span class="Apple-converted-space"> </span><<a href="http://mydomain.com/" class="">http://mydomain.com/</a>>><br class=""><br class=""># Static IP configs<br class=""><br class="">conn static-ip-for-strike<br class=""> also="ikev2-mschapv2-apple"<br class=""> right=%any<br class=""> rightid=strike<br class=""> rightsourceip=10.8.0.100/32<br class=""> auto=add<br class=""><br class="">conn static-ip-for-dottas<br class=""> also="ikev2-mschapv2"<br class=""> right=%any<br class=""> rightid=dottas<br class=""> rightsourceip=10.8.0.33/32<br class=""> auto=add<br class=""></blockquote><br class="">All iOS clients connect fine and take static IP but Windows always get an IP address by DHCP pool. If I delete rightsourceip=10.8.0.0/24 field Windows dont recibe any IP address and dont connect.<br class=""><br class="">Some log outputs:<br class=""><br class="">ipsec leases<br class=""><br class=""><blockquote type="cite" class=""><br class="">Leases in pool '10.8.0.0/24', usage: 0/254, 0 online<br class="">no matching leases found<br class="">Leases in pool '10.8.0.33/32', usage: 0/1, 0 online<br class="">no matching leases found<br class="">Leases in pool '10.8.0.100/32', usage: 0/1, 0 online<br class="">no matching leases found<br class="">...<br class=""></blockquote><br class="">journalctl -f -u strongswan<br class=""><br class=""><blockquote type="cite" class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] IKE_SA ikev2-mschapv2[1] state change: CONNECTING => ESTABLISHED<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] peer requested virtual IP %any<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] assigning new lease to 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] assigning virtual IP 10.8.0.1 to peer 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] peer requested virtual IP %any6<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] no virtual IP found for %any6 requested by 'dottas'<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] building INTERNAL_IP4_DNS attribute<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] looking for a child config for 0.0.0.0/0 ::/0 === 0.0.0.0/0 ::/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposing traffic selectors for us:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] 0.0.0.0/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposing traffic selectors for other:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] candidate "ikev2-mschapv2" with prio 10+2<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] found matching child config "ikev2-mschapv2" with prio 12<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] no acceptable ENCRYPTION_ALGORITHM found<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting proposal:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] proposal matches<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] received proposals: ESP:AES_CBC_256/HMAC_SHA1_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] configured proposals: ESP:AES_CBC_128/HMAC_SHA1_96/NO_EXT_SEQ, ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selected proposal: ESP:3DES_CBC/HMAC_SHA1_96/NO_EXT_SEQ<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting traffic selectors for us:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 0.0.0.0/0, received: 0.0.0.0/0 => match: 0.0.0.0/0<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 0.0.0.0/0, received: ::/0 => no match<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] selecting traffic selectors for other:<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 10.8.0.1/32, received: 0.0.0.0/0 => match: 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[CFG] config: 10.8.0.1/32, received: ::/0 => no match<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] CHILD_SA ikev2-mschapv2{1} established with SPIs ccd1079d_i 9a38f558_o and TS 0.0.0.0/0 === 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[IKE] CHILD_SA ikev2-mschapv2{1} established with SPIs ccd1079d_i 9a38f558_o and TS 0.0.0.0/0 === 10.8.0.1/32<br class="">Mar 07 21:53:29 900333e2e8f1 charon[5111]: 12[ENC] generating IKE_AUTH response 5 [ AUTH CPRP(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_4_ADDR) N(ADD_4_ADDR) ]<br class="">...<br class=""></blockquote><br class="">ipsec leases<br class=""><br class=""><blockquote type="cite" class="">Leases in pool '10.8.0.0/24', usage: 1/254, 0 online<br class=""> 10.8.0.1 online 'dottas'<br class="">Leases in pool '10.8.0.33/32', usage: 0/1, 0 online<br class="">no matching leases found<br class="">Leases in pool '10.8.0.100/32', usage: 0/1, 0 online<br class="">no matching leases found<br class="">...<br class=""></blockquote><br class=""><br class="">Any idea to assign static ip address to windows clients?<br class=""><br class="">Thank you.<br class=""><br class=""><br class=""><br class=""><br class=""><br class=""><br class="">_______________________________________________<br class="">Users mailing list<br class=""><a href="mailto:Users@lists.strongswan.org" class="">Users@lists.strongswan.org</a><span class="Apple-converted-space"> </span><<a href="mailto:Users@lists.strongswan.org" class="">mailto:Users@lists.strongswan.org</a>><br class=""><a href="https://lists.strongswan.org/mailman/listinfo/users" class="">https://lists.strongswan.org/mailman/listinfo/users</a><br class=""><br class=""></blockquote><br class="">--<span class="Apple-converted-space"> </span><br class=""><br class="">Mit freundlichen Grüßen/Kind Regards,<br class="">Noel Kuntze<br class=""><br class="">GPG Key ID: 0x63EC6658<br class="">Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br class=""></blockquote><br class=""><br class=""><br class="">_______________________________________________<br class="">Users mailing list<br class=""><a href="mailto:Users@lists.strongswan.org" class="">Users@lists.strongswan.org</a><br class="">https://lists.strongswan.org/mailman/listinfo/users<br class=""><br class=""></blockquote><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Mit freundlichen Grüßen/Kind Regards,</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Noel Kuntze</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">GPG Key ID: 0x63EC6658</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658</span></div></blockquote></div><br class=""></div></div></div></body></html>