<html><head></head><body><div style="font-family:Helvetica Neue, Helvetica, Arial, sans-serif;font-size:10px;"><div><b>Version: strongSwan 5.6.2 using swanctl</b></div><div><br></div><div>I am trying to re-use settings so that just the certificate is different (vpnserver uses ECDSA, vpnsever1 uses RSA), which according to the help page [1] should be possible:</div><div><br></div><div>"</div><div><span><div><b>connections.<conn>.local<suffix> section</b></div></span><span><div>Section for a local authentication round. A local authentication round defines the rules how authentication is performed for the local peer. Multiple rounds may be defined to use IKEv2 RFC 4739 Multiple Authentication or IKEv1 XAuth.</div><div>Each round is defined in a section having local as prefix, and an optional unique suffix. To define a single authentication round, the suffix may be omitted.</div></span>"</div><div><br></div><div>However, when I connect from OSX (using Local ID = vpnserver1), strongSwan doesn't match to a local peer.</div><div><br></div><div><div>May 1 21:17:10 09[CFG] looking for peer configs matching 10.0.5.202[vpnserver1]...86.2.58.36[192.168.0.31]</div><div>May 1 21:17:10 09[CFG] peer config match local: 0 (ID_FQDN -> 76:70:6e:73:65:72:76:65:72:31)</div><div>May 1 21:17:10 09[CFG] peer config match remote: 1 (ID_IPV4_ADDR -> c0:a8:00:1f)</div><div>May 1 21:17:10 09[CFG] ike config match: 28 (10.0.5.202 86.2.58.36 IKEv2)</div><div>May 1 21:17:10 09[CFG] <b>no matching peer config found</b></div><div><br></div></div><div>I have tried prefixing fqdn:vpnserver1, @vpnserver1, I have even tried by IP addresses on both the private IP and public IP (adding them in to the certificates as both DNS:x.x.x.x and IP:x.x.x.x - not shown in the certs below as I removed them after trying)</div><div><br></div><div><br></div><div>When I connect from Windows which uses ID_ANY, it picks the first one in the list "<b>local</b>" (as expected).</div><div><br></div><div><br></div><div><span><div>```<br>connections {</div><div> default {</div><div> version = 2</div><div> send_cert = always</div><div> encap = yes</div><div> pools = pool1</div><div> unique = replace</div><div> local {</div><div> id = vpnserver</div><div> certs = vpnserver.crt</div><div> }</div><div> local1 {</div><div> id = vpnserver1</div><div> certs = vpnserver1.crt</div><div> }</div><div> remote {</div><div> auth = eap-mschapv2</div><div> eap_id = %any</div><div> #revocation = strict # OCSP must be running</div><div> }</div><div> children {</div><div> net {</div><div> local_ts = 10.0.0.0/20</div><div> inactivity = 1h</div><div> }</div><div> }</div><div> }</div><div>}</div></span>```</div><div><br></div><div>```</div><div><span><div>List of X.509 End Entity Certificates</div><div><br></div><div> subject: "CN=vpnserver1"</div><div> issuer: "CN=Root CA"</div><div> validity: not before May 01 17:18:52 2018, ok</div><div> not after May 31 17:18:52 2019, ok (expires in 394 days)</div><div> serial: c2:79:0c:c6:8b:27:50:6a</div><div> altNames: vpnserver1</div><div> flags: serverAuth ikeIntermediate </div><div> OCSP URIs: http://127.0.0.1:2560</div><div> authkeyId: ff:4e:05:ee:8a:b3:d7:24:62:96:78:9a:b6:f0:51:82:b4:8f:f9:50</div><div> subjkeyId: 98:e8:e0:53:18:0a:d4:1c:38:40:23:ed:1b:3f:a3:13:53:e9:1d:09</div><div> pubkey: RSA 2048 bits, has private key</div><div> keyid: ff:b9:af:34:56:ec:7b:33:e5:3f:67:35:43:1d:98:61:ca:73:bf:b1</div><div> subjkey: 98:e8:e0:53:18:0a:d4:1c:38:40:23:ed:1b:3f:a3:13:53:e9:1d:09</div><div><br></div><div> subject: "CN=vpnserver"</div><div> issuer: "CN=Root CA"</div><div> validity: not before May 01 14:33:35 2018, ok</div><div> not after May 31 14:33:35 2019, ok (expires in 394 days)</div><div> serial: c2:79:0c:c6:8b:27:50:69</div><div> altNames: vpnserver</div><div> flags: serverAuth ikeIntermediate </div><div> OCSP URIs: http://127.0.0.1:2560</div><div> authkeyId: ff:4e:05:ee:8a:b3:d7:24:62:96:78:9a:b6:f0:51:82:b4:8f:f9:50</div><div> subjkeyId: 52:8e:b0:37:4f:ef:c5:79:43:8f:e1:29:6d:0b:cf:6a:65:58:b3:35</div><div> pubkey: ECDSA 384 bits, has private key</div><div> keyid: ef:5a:f5:de:7d:ab:a2:40:e5:53:27:0b:e8:2c:54:3f:28:e7:0c:c4</div><div> subjkey: 52:8e:b0:37:4f:ef:c5:79:43:8f:e1:29:6d:0b:cf:6a:65:58:b3:35</div><div>```</div></span><br></div><div><span><div>May 1 21:09:56 11[CFG] vici client 1 requests: load-conn</div><div>May 1 21:09:56 11[CFG] conn default:</div><div>May 1 21:09:56 11[CFG] child net:</div><div>May 1 21:09:56 11[CFG] rekey_time = 3600</div><div>May 1 21:09:56 11[CFG] life_time = 3960</div><div>May 1 21:09:56 11[CFG] rand_time = 360</div><div>May 1 21:09:56 11[CFG] rekey_bytes = 0</div><div>May 1 21:09:56 11[CFG] life_bytes = 0</div><div>May 1 21:09:56 11[CFG] rand_bytes = 0</div><div>May 1 21:09:56 11[CFG] rekey_packets = 0</div><div>May 1 21:09:56 11[CFG] life_packets = 0</div><div>May 1 21:09:56 11[CFG] rand_packets = 0</div><div>May 1 21:09:56 11[CFG] updown = (null)</div><div>May 1 21:09:56 11[CFG] hostaccess = 0</div><div>May 1 21:09:56 11[CFG] ipcomp = 0</div><div>May 1 21:09:56 11[CFG] mode = TUNNEL</div><div>May 1 21:09:56 11[CFG] policies = 1</div><div>May 1 21:09:56 11[CFG] policies_fwd_out = 0</div><div>May 1 21:09:56 11[CFG] dpd_action = clear</div><div>May 1 21:09:56 11[CFG] start_action = clear</div><div>May 1 21:09:56 11[CFG] close_action = clear</div><div>May 1 21:09:56 11[CFG] reqid = 0</div><div>May 1 21:09:56 11[CFG] tfc = 0</div><div>May 1 21:09:56 11[CFG] priority = 0</div><div>May 1 21:09:56 11[CFG] interface = (null)</div><div>May 1 21:09:56 11[CFG] mark_in = 0/0</div><div>May 1 21:09:56 11[CFG] mark_in_sa = 0</div><div>May 1 21:09:56 11[CFG] mark_out = 0/0</div><div>May 1 21:09:56 11[CFG] inactivity = 3600</div><div>May 1 21:09:56 11[CFG] proposals = ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/NO_EXT_SEQ</div><div>May 1 21:09:56 11[CFG] local_ts = 10.0.0.0/20</div><div>May 1 21:09:56 11[CFG] remote_ts = dynamic</div><div>May 1 21:09:56 11[CFG] hw_offload = 0</div><div>May 1 21:09:56 11[CFG] sha256_96 = 0</div><div>May 1 21:09:56 11[CFG] version = 2</div><div>May 1 21:09:56 11[CFG] local_addrs = %any</div><div>May 1 21:09:56 11[CFG] remote_addrs = %any</div><div>May 1 21:09:56 11[CFG] local_port = 500</div><div>May 1 21:09:56 11[CFG] remote_port = 500</div><div>May 1 21:09:56 11[CFG] send_certreq = 1</div><div>May 1 21:09:56 11[CFG] send_cert = CERT_ALWAYS_SEND</div><div>May 1 21:09:56 11[CFG] mobike = 1</div><div>May 1 21:09:56 11[CFG] aggressive = 0</div><div>May 1 21:09:56 11[CFG] dscp = 0x00</div><div>May 1 21:09:56 11[CFG] encap = 1</div><div>May 1 21:09:56 11[CFG] dpd_delay = 0</div><div>May 1 21:09:56 11[CFG] dpd_timeout = 0</div><div>May 1 21:09:56 11[CFG] fragmentation = 2</div><div>May 1 21:09:56 11[CFG] unique = UNIQUE_REPLACE</div><div>May 1 21:09:56 11[CFG] keyingtries = 1</div><div>May 1 21:09:56 11[CFG] reauth_time = 0</div><div>May 1 21:09:56 11[CFG] rekey_time = 14400</div><div>May 1 21:09:56 11[CFG] over_time = 1440</div><div>May 1 21:09:56 11[CFG] rand_time = 1440</div><div>May 1 21:09:56 11[CFG] proposals = IKE:AES_CBC_128/AES_CBC_192/AES_CBC_256/CAMELLIA_CBC_128/CAMELLIA_CBC_192/CAMELLIA_CBC_256/3DES_CBC/HMAC_SHA2_256_128/HMAC_SHA2_384_192/HMAC_SHA2_512_256/HMAC_SHA1_96/AES_XCBC_96/AES_CMAC_96/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048, IKE:AES_GCM_16_128/AES_GCM_16_192/AES_GCM_16_256/AES_GCM_12_128/AES_GCM_12_192/AES_GCM_12_256/AES_GCM_8_128/AES_GCM_8_192/AES_GCM_8_256/PRF_HMAC_SHA2_256/PRF_HMAC_SHA2_384/PRF_HMAC_SHA2_512/PRF_AES128_XCBC/PRF_AES128_CMAC/PRF_HMAC_SHA1/ECP_256/ECP_384/ECP_521/ECP_256_BP/ECP_384_BP/ECP_512_BP/CURVE_25519/MODP_3072/MODP_4096/MODP_6144/MODP_8192/MODP_2048</div><div><b>May 1 21:09:56 11[CFG] local:</b></div><div><b>May 1 21:09:56 11[CFG] id = vpnserver</b></div><div><b>May 1 21:09:56 11[CFG] local:</b></div><div><b>May 1 21:09:56 11[CFG] id = vpnserver1</b></div><div>May 1 21:09:56 11[CFG] remote:</div><div>May 1 21:09:56 11[CFG] eap_id = %any</div><div>May 1 21:09:56 11[CFG] eap-type = EAP_MSCHAPV2</div><div>May 1 21:09:56 11[CFG] class = EAP</div><div>May 1 21:09:56 11[CFG] added vici connection: default</div><div><br></div><div><br></div><div>[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf" rel="nofollow" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf</a></div><div><br></div></span><br></div></div></body></html>