<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I am trying to set up StrongSwan VPN on Ubuntu for iPhone (iOS 10) road warriors. I want my iOS clients to authenticate with username and password. After a couple of days of trial-and-error I believe I am close, but the client is not completing the connection. This is the end of the log:<div class=""><br class=""></div><div class=""><div class=""><font face="Courier New" class="">charon: 13[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</font></div><div class=""><font face="Courier New" class="">charon: 13[IKE] peer supports MOBIKE</font></div><div class=""><font face="Courier New" class="">charon: 13[IKE] authentication of 'server' (myself) with RSA signature successful</font></div><div class=""><font face="Courier New" class="">charon: 13[ENC] generating IKE_AUTH response 1 [ IDr AUTH EAP/REQ/MSCHAPV2 ]</font></div><div class=""><font face="Courier New" class="">charon: 13[NET] sending packet: from x.x.x.x[4500] to y.y.y.y[26349] (384 bytes)</font></div><div class=""><font face="Courier New" class="">charon: 10[NET] sending packet: from x.x.x.x[4500] to y.y.y.y[26349]</font></div><div class=""><font face="Courier New" color="#ff2600" class="">charon: 14[JOB] deleting half open IKE_SA after timeout</font></div><div class=""><font face="Courier New" color="#ff2600" class="">charon: 14[IKE] IKE_SA ios10[1] state change: CONNECTING => DESTROYING</font></div></div><div class=""><br class=""></div><div class="">Below is my setup.</div><div class=""><br class=""></div><div class=""><u class="">Key and certificate generation</u></div><div class=""><br class=""></div><div class=""><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><font face="Courier New" class=""># ipsec pki --gen > caKey.der</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">ipsec pki --self --in caKey.der --dn "C=CH, O=strongSwan, CN=strongSwan CA" --ca > caCert.der</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">ipsec pki --gen > peerKey.der</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">ipsec pki --pub --in peerKey.der | ipsec pki --issue --cacert caCert.der --cakey caKey.der --san server --dn "C=CH, O=strongSwan, CN=peer" > peerCert.der</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">mv caCert.der /etc/ipsec.d/cacerts/</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">mv peerKey.der /etc/ipsec.d/private/</font></div><div style="margin: 0px; line-height: normal; color: rgb(69, 69, 69);" class=""><span style="font-family: 'Courier New';" class="">#</span><span style="font-family: 'Courier New';" class=""> </span><font face="Courier New" class="">mv peerCert.der /etc/ipsec.d/certs/</font></div></div><div class=""><br class=""></div><div class=""><u class="">StrongSwan configuration</u></div><div class=""><br class=""></div><div class=""><div class=""><span style="font-family: 'Courier New';" class="">—————</span></div></div><div class=""><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""># ipsec.conf - strongSwan IPsec configuration file</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255); min-height: 13px;" class=""><font face="Courier New" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">config setup</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><font face="Courier New" class=""> charondebug="cfg 2, dmn 2, ike 2, net 2"</font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255); min-height: 13px;" class=""><font face="Courier New" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">conn %default</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> keyexchange=ikev2</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><font face="Courier New" class=""> ikelifetime=60m</font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> keylife=20m</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> rekeymargin=3m</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> keyingtries=1</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255); min-height: 13px;" class=""><font face="Courier New" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""></span><br class=""></font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">conn ios10 </font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> leftid=server</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> leftcert=peerCert.der</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> rightauth=eap-mschapv2</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> leftsubnet=0.0.0.0/0</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class=""> auto=add</font></span></div></div></div><div class=""><div class=""><font face="Courier New" class="">—————</font></div></div><div class=""><font face="Courier New" class=""># ipsec.secrets</font></div><div class=""><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><font face="Courier New" class=""><br class=""></font></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">: RSA peerKey.der</font></span></div><div style="margin: 0px; font-size: 11px; line-height: normal; background-color: rgb(255, 255, 255);" class=""><span style="font-variant-ligatures: no-common-ligatures" class=""><font face="Courier New" class="">myusername : EAP "abc123xyz"</font></span></div><div class=""><font face="Courier New" class="">—————</font></div></div><div class=""><br class=""></div><div class=""><u class="">iPhone client configuration</u></div><div class=""><br class=""></div><div class=""><div class="">Type: IKEv2</div><div class="">Description: "My VPN Server"</div><div class="">Server: <IP address of server></div><div class="">Remote ID: "server"</div><div class="">Local ID: "client"</div><div class="">User Authentication: Username</div><div class="">Username: "myusername"</div><div class="">Password: "abc123xyz"</div></div><div class=""><br class=""></div><div class=""><u class="">Server log at startup</u></div><div class=""><br class=""></div><div class=""><div class=""><font face="Courier New" class="">charon: 00[DMN] signal of type SIGINT received. Shutting down</font></div><div class=""><font face="Courier New" class="">charon: 00[DMN] Starting IKE charon daemon (strongSwan 5.3.5, Linux 4.4.0-66-generic, x86_64)</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loaded ca certificate "C=CH, O=strongSwan, CN=strongSwan CA" from '/etc/ipsec.d/cacerts/caCert.der'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading crls from '/etc/ipsec.d/crls'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loading secrets from '/etc/ipsec.secrets'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loaded RSA private key from '/etc/ipsec.d/private/peerKey.der'</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loaded EAP secret for myusername</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] opening triplet file /etc/ipsec.d/triplets.dat failed: No such file or directory</font></div><div class=""><font face="Courier New" class="">charon: 00[CFG] loaded 0 RADIUS server configurations</font></div><div class=""><font face="Courier New" class="">charon: 00[LIB] loaded plugins: charon test-vectors aes rc2 sha1 sha2 md4 md5 random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl fips-prf gmp agent xcbc hmac gcm attr kernel-netlink resolve socket-default connmark farp stroke updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam xauth-noauth tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp lookip error-notify certexpire led addrblock unity</font></div><div class=""><font face="Courier New" class="">charon: 00[LIB] dropped capabilities, running as uid 0, gid 0</font></div><div class=""><font face="Courier New" class="">charon: 00[JOB] spawning 16 worker threads</font></div><div class=""><font face="Courier New" class="">charon: 06[NET] waiting for data on sockets</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] received stroke: add connection 'ios10'</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] conn ios10</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] left=%any</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] leftsubnet=0.0.0.0/0</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] leftid=server</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] leftcert=peerCert.der</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] right=%any</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] rightauth=eap-mschapv2</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] ike=aes128-sha1-modp2048,3des-sha1-modp1536</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] esp=aes128-sha1,3des-sha1</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] dpddelay=30</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] dpdtimeout=150</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] mediation=no</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] keyexchange=ikev2</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] loaded certificate "C=CH, O=strongSwan, CN=peer" from 'peerCert.der'</font></div><div class=""><font face="Courier New" class="">charon: 10[CFG] added configuration 'ios10'</font></div></div><div class=""><br class=""></div><div class=""><u class="">Server log at connection attempt</u></div><div class=""><br class=""></div><div class=""><div class=""><div class=""><font face="Courier New" class="">charon: 06[NET] received packet: from x.x.x.x[17279] to y.y.y.y[500]</font></div><div class=""><font face="Courier New" class="">charon: 06[NET] waiting for data on sockets</font></div><div class=""><font face="Courier New" class="">charon: 05[NET] received packet: from x.x.x.x[17279] to y.y.y.y[500] (604 bytes)</font></div><div class=""><font face="Courier New" class="">charon: 05[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] looking for an ike config for y.y.y.y...x.x.x.x</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] candidate: %any...%any, prio 28</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] found matching ike config: %any...%any with prio 28</font></div><div class=""><font face="Courier New" class="">charon: 05[IKE] x.x.x.x is initiating an IKE_SA</font></div><div class=""><font face="Courier New" class="">charon: 05[IKE] IKE_SA (unnamed)[1] state change: CREATED => CONNECTING</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable DIFFIE_HELLMAN_GROUP found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable ENCRYPTION_ALGORITHM found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] no acceptable DIFFIE_HELLMAN_GROUP found</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selecting proposal:</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] proposal matches</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] received proposals: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256, IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] configured proposals: IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_2048, IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1536, IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/HMAC_MD5_96/HMAC_SHA1_96/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/AES_XCBC_96/PRF_HMAC_MD5/PRF_HMAC_SHA1/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/MODP_2048/MODP_2048_224/MODP_2048_256/MODP_1536/MODP_3072/MODP_4096/MODP_8192/MODP_1024/MODP_1024_160/ECP_256/ECP_384/ECP_521/ECP_224/ECP_192/ECP_224_BP/ECP_256_BP/ECP_384_BP/ECP_512_BP, IKE:AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/PRF_HMAC_MD5/PRF_HMAC_SHA1/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/MODP_2048/MODP_2048_224/MODP_2048_256/MODP_1536/MODP_3072/MODP_4096/MODP_8192/MODP_1024/MODP_1024_160/ECP_256/ECP_384/ECP_521/ECP_224/ECP_192/ECP_224_BP/ECP_256_BP/ECP_384_BP/ECP_512_BP</font></div><div class=""><font face="Courier New" class="">charon: 05[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048</font></div><div class=""><font face="Courier New" class="">charon: 05[IKE] remote host is behind NAT</font></div><div class=""><font face="Courier New" class="">charon: 05[IKE] sending cert request for "C=CH, O=strongSwan, CN=strongSwan CA"</font></div><div class=""><font face="Courier New" class="">charon: 05[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(MULT_AUTH) ]</font></div><div class=""><font face="Courier New" class="">charon: 05[NET] sending packet: from y.y.y.y[500] to x.x.x.x[17279] (465 bytes)</font></div><div class=""><font face="Courier New" class="">charon: 09[NET] sending packet: from y.y.y.y[500] to x.x.x.x[17279]</font></div><div class=""><font face="Courier New" class="">charon: 06[NET] received packet: from x.x.x.x[26601] to y.y.y.y[4500]</font></div><div class=""><font face="Courier New" class="">charon: 06[NET] waiting for data on sockets</font></div><div class=""><font face="Courier New" class="">charon: 12[NET] received packet: from x.x.x.x[26601] to y.y.y.y[4500] (496 bytes)</font></div><div class=""><font face="Courier New" class="">charon: 12[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]</font></div><div class=""><font face="Courier New" class="">charon: 12[CFG] looking for peer configs matching y.y.y.y[server]...x.x.x.x[client]</font></div><div class=""><font face="Courier New" class="">charon: 12[CFG] candidate "ios10", match: 20/1/28 (me/other/ike)</font></div><div class=""><font face="Courier New" class="">charon: 12[CFG] selected peer config 'ios10'</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] initiating EAP_MSCHAPV2 method (id 0x24)</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP4_ADDRESS attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP4_DHCP attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP4_DNS attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP4_NETMASK attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP6_ADDRESS attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP6_DHCP attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] processing INTERNAL_IP6_DNS attribute</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] peer supports MOBIKE</font></div><div class=""><font face="Courier New" class="">charon: 12[IKE] authentication of 'server' (myself) with RSA signature successful</font></div><div class=""><font face="Courier New" class="">charon: 12[ENC] generating IKE_AUTH response 1 [ IDr AUTH EAP/REQ/MSCHAPV2 ]</font></div><div class=""><font face="Courier New" class="">charon: 12[NET] sending packet: from y.y.y.y[4500] to x.x.x.x[26601] (384 bytes)</font></div><div class=""><font face="Courier New" class="">charon: 09[NET] sending packet: from y.y.y.y[4500] to x.x.x.x[26601]</font></div><div class=""><br class=""></div></div></div><div class="">And 30 seconds later…</div><div class=""><br class=""></div><div class=""><div class=""><div class=""><font face="Courier New" class="">charon: 13[JOB] deleting half open IKE_SA after timeout</font></div><div class=""><font face="Courier New" class="">charon: 13[IKE] IKE_SA ios10[1] state change: CONNECTING => DESTROYING</font></div></div></div><div class=""><font face="Courier New" class=""><br class=""></font></div><div class="">It behaves the exact same way if I try to connect from my Mac.</div><div class="">What is missing to make it work?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">John</div></body></html>