[strongSwan] swanctl.conf debugging-- fails to load certificates
stephen.ayotte at gmail.com
Thu May 11 18:39:13 CEST 2017
Thanks Tobias!! That did the trick. Specifically I added this to the config
In my defense regarding that load statement, I was working from this
Everything's loading successfully now, and I see the beginning of an IKEv2
negotiation when I ping from one host to the other. Great progress!
> but the local_addrs/remote_addrs/local_ts/remote_ts +
> > start_action=trap in swanctl.conf looks like it should get the job done.
> You can do the same thing with ipsec.conf.
I'm missing how... it seems like all the examples include both a "left" and
a "right", the rvals for which can be IP addresses but not CIDR blocks.
Could you nudge me in the right direction with a keyword or something I can
search / read on to figure out how to do that?
Semi-related observation: there are more examples / richer documentation
for ipsec.conf, including web search results, than for swanctl.conf. All
else being equal, I'd rather be in the mainstream so I can use other
people's known-good configs as a reference point. Is the intent to
eventually deprecate ipsec.conf in favor of swanctl, or is swanctl just an
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users