<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">I’m replying to my own e-mail here, but with help from Benn of PiStrong fame, I was able to figure out what I had omitted from my configuration: It was the Subject Alt Names in the certificates.<div class=""><br class=""></div><div class="">Specifically, I read Noel’s note to remove the SAN for the IP Address from the cert and unwisely left out all SANs. In the end, adding “DNS:myhost.mydom.dom” to the server’s certificate and “<a href="mailto:user@mydom.dom" class="">email:user@mydom.dom</a>” to the Mac’s certificate solved the issue.</div><div class=""><br class=""></div><div class="">Thank you for your patience and my apologies for the wasted bandwidth.</div><div class=""><br class=""></div><div class="">Tom<br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Dec 9, 2018, at 10:12 AM, Tom Rymes <<a href="mailto:trymes@rymes.com" class="">trymes@rymes.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">My apologies for having to ask about this again, but I am stuck trying to make a MacOS IPSec connection to Strongswan. I had similar issues in the past, and Noel kindly helped me out, and I thought I had it all documented, but here I am again. Once again, Strongswan is reporting that it cannot find a matching peer config.<br class=""><br class="">Noel’s response to my last post: <a href="https://lists.strongswan.org/pipermail/users/2018-January/012155.html" class="">https://lists.strongswan.org/pipermail/users/2018-January/012155.html</a><br class=""><br class="">Once again, I’m sure this is me doing something dumb here, but I cannot figure out what it is.<br class=""><br class="">[root@MyHost ~]# ipsec --version<br class="">Linux strongSwan U5.6.3/K4.14.72-ipfire<br class=""><br class="">conn MacIPSec<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>left=x.x.x.x<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>leftsubnet=0.0.0.0/0<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>right=%any<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>leftcert=/var/ipfire/certs/hostcert.pem<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>rightcert=/var/ipfire/certs/MacIPSeccert.pem<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>leftid=myhost.mydom.dom<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span><a href="mailto:rightid=user@mydom.dom" class="">rightid=user@mydom.dom</a><br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>ike=aes256-sha2_384-ecp384,aes256-sha2_384-ecp256,aes256-sha2_256-ecp384,aes256-sha2_256-ecp256!<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>esp=aes256-sha2_384-ecp384,aes256-sha2_384-ecp256,aes256-sha2_256-ecp384,aes256-sha2_256-ecp256!<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>keyexchange=ikev2<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>ikelifetime=3h<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>keylife=1h<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>dpdaction=clear<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>dpddelay=30<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>dpdtimeout=120<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>auto=add<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>rightsourceip=10.252.0.240/28<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>fragmentation=yes<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>leftsendcert=always<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>leftallowany=yes<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>rightdns=10.252.0.1<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>rekey=no<br class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>reauth=no<br class=""><br class="">When starting Strongswan, these messages are logged:<br class=""><br class="">Dec 9 09:47:30 MyHost charon: 06[CFG] id ‘myhost.mydom.dom' not confirmed by certificate, defaulting to 'C=US, ST=ST, O=MyOrg, OU=My Dept., CN=myhost.mydom.dom' <br class="">Dec 9 09:47:30 TheShack charon: 06[CFG] id ‘<a href="mailto:user@mydom.dom" class="">user@mydom.dom</a>' not confirmed by certificate, defaulting to 'C=US, ST=ST, O=MyOrg, OU=My Dept., CN=MacIPSec' <br class=""><br class=""><br class="">And this hits the logs when I try to connect: <br class=""><br class="">Dec 9 09:47:50 MyHost charon: 16[NET] received packet: from y.y.y.y[500] to x.x.x.x[500] (604 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 16[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ] <br class="">Dec 9 09:47:50 MyHost charon: 16[IKE] y.y.y.y is initiating an IKE_SA <br class="">Dec 9 09:47:50 MyHost charon: 16[IKE] y.y.y.y is initiating an IKE_SA <br class="">Dec 9 09:47:50 MyHost charon: 16[IKE] remote host is behind NAT <br class="">Dec 9 09:47:50 MyHost charon: 16[IKE] DH group MODP_2048 inacceptable, requesting ECP_256 <br class="">Dec 9 09:47:50 MyHost charon: 16[ENC] generating IKE_SA_INIT response 0 [ N(INVAL_KE) ] <br class="">Dec 9 09:47:50 MyHost charon: 16[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500] (38 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 06[NET] received packet: from y.y.y.y[500] to x.x.x.x[500] (412 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 06[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ] <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] y.y.y.y is initiating an IKE_SA <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] y.y.y.y is initiating an IKE_SA <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] remote host is behind NAT <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] sending cert request for "C=US, ST=ST, L=MyTown, O=MyOrg, OU=My Dept., CN=MyOrg CA, <a href="mailto:E=user@mydom.dom" class="">E=user@mydom.dom</a>" <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] sending cert request for "C=US, ST=ST, L=MyTown, O=MyOrg, OU=My Dept, CN=MyOrg CA, <a href="mailto:E=user@mydom.dom" class="">E=user@mydom.dom</a>" <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] sending cert request for "C=US, ST=ST, L=OtherTown, O=MyOrg, OU=My Dept., CN=MyOrg CA, <a href="mailto:E=user@mydom.dom" class="">E=user@mydom.dom</a>" <br class="">Dec 9 09:47:50 MyHost charon: 06[IKE] sending cert request for "C=US, ST=ST, L=OtherTown2, O=MyOrg, OU=My Dept, CN=MyOrg CA, <a href="mailto:E=user@mydom.dom" class="">E=user@mydom.dom</a>" <br class="">Dec 9 09:47:50 MyHost charon: 06[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(FRAG_SUP) N(MULT_AUTH) ] <br class="">Dec 9 09:47:50 MyHost charon: 06[NET] sending packet: from x.x.x.x[500] to y.y.y.y[500] (341 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 05[NET] received packet: from y.y.y.y[4500] to x.x.x.x[4500] (532 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 05[ENC] parsed IKE_AUTH request 1 [ EF(1/5) ] <br class="">Dec 9 09:47:50 MyHost charon: 05[ENC] received fragment #1 of 5, waiting for complete IKE message <br class="">Dec 9 09:47:50 MyHost charon: 08[NET] received packet: from y.y.y.y[4500] to x.x.x.x[4500] (532 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 08[ENC] parsed IKE_AUTH request 1 [ EF(2/5) ] <br class="">Dec 9 09:47:50 MyHost charon: 08[ENC] received fragment #2 of 5, waiting for complete IKE message <br class="">Dec 9 09:47:50 MyHost charon: 07[NET] received packet: from y.y.y.y[4500] to x.x.x.x[4500] (532 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 07[ENC] parsed IKE_AUTH request 1 [ EF(3/5) ] <br class="">Dec 9 09:47:50 MyHost charon: 07[ENC] received fragment #3 of 5, waiting for complete IKE message <br class="">Dec 9 09:47:50 MyHost charon: 09[NET] received packet: from y.y.y.y[4500] to x.x.x.x[4500] (532 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 09[ENC] parsed IKE_AUTH request 1 [ EF(4/5) ] <br class="">Dec 9 09:47:50 MyHost charon: 09[ENC] received fragment #4 of 5, waiting for complete IKE message <br class="">Dec 9 09:47:50 MyHost charon: 11[NET] received packet: from y.y.y.y[4500] to x.x.x.x[4500] (132 bytes) <br class="">Dec 9 09:47:50 MyHost charon: 11[ENC] parsed IKE_AUTH request 1 [ EF(5/5) ] <br class="">Dec 9 09:47:50 MyHost charon: 11[ENC] received fragment #5 of 5, reassembling fragmented IKE message <br class="">Dec 9 09:47:50 MyHost charon: 11[ENC] unknown attribute type (25) <br class="">Dec 9 09:47:50 MyHost charon: 11[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr AUTH CERT CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6 DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ] <br class="">Dec 9 09:47:50 TheShack charon: 11[IKE] received end entity cert "C=US, ST=ST, O=MyOrg, OU=My Dept., CN=MacIPSec" <br class="">Dec 9 09:47:50 TheShack charon: 11[CFG] looking for peer configs matching x.x.x.x[myhost.mydom.dom]…y.y.y.y[<a href="mailto:user@mydom.dom" class="">user@mydom.dom</a>] <br class="">Dec 9 09:47:50 TheShack charon: 11[CFG] no matching peer config found <br class="">Dec 9 09:47:50 TheShack charon: 11[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding <br class="">Dec 9 09:47:50 TheShack charon: 11[IKE] peer supports MOBIKE <br class="">Dec 9 09:47:50 TheShack charon: 11[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ] <br class=""><br class="">Many thanks,<br class=""><br class="">Tom</div></div></blockquote></div><br class=""></div></body></html>