Does the ID need to be the actual hostname, external dns name, or just the name matching the cert. We use .local internally (based on an SBS install) so by default we generate hostnames/dns entries based on .local. We do have a public external name for the vpn endpoints. I just don't know if it matters or now to strongSwan. Thanks, Gary Smith