> Does Strongswan uses the IP address specified in the CP payload > sent by the client during IKE AUTH exchange ? Depends on the virtual IP backend. The in-memory pool honors that request only in the specific case where the reassign_online option is set to reassign an active lease to the new (re-authenticated) IKE_SA. Regards Martin