[strongSwan] IKEv2 cisco anyconnect app
martin at strongswan.org
Tue Apr 22 10:19:21 CEST 2014
> I notice you mention in your response that strongswan is rejecting an
> unencrypted payload that it expects to be encrypted.
I assume you are referring to the one-and-a-half year old discussion at
> However, this particular attribute is included in Message 1 which can't
> be encrypted. So why is strongswan expecting the payload to be
While this is true, strongSwan still rejects an unencrypted
configuration payload message. It just does not expect a configuration
payload in IKE_SA_INIT.
So the question is: Why does Anyconnect send a configuration payload in
IKE_SA_INIT? Even if it might not be explicitly disallowed, the
configuration payload is certainly not used here as intended in RFC5996.
As said, working around this issue might be possible, but I don't think
it makes much sense given the mentioned Cisco EULA restrictions.
More information about the Users