[strongSwan] Help! I can't configure Windows 10 to send remote id (leftid) for IKEv2

[bls s]

I'm curious about this as well. From my work on pistrong (see elsewhere), it looks to me like Windows doesn't have a way to send an ID that you can use for matching. I haven't tried this, but you might be able to make it work by using a separate "VPN certificate" for the Windows connection that has an altname in it corresponding to a secondary DNS name for your server. You can then have Windows connect to the secondary DNS name and, in theory, it would eventually match that connection.

Again, just a theory, I'm definitely interested in other approaches to solving this.
________________________________
From: Users <users-bounces at lists.strongswan.org> on behalf of Marwan Khalili <choklad_321 at hotmail.com>
Sent: Tuesday, September 25, 2018 7:47 AM
To: users at lists.strongswan.org
Subject: [strongSwan] Help! I can't configure Windows 10 to send remote id (leftid) for IKEv2

Hello,

I have a strongSwan server running with the ipsec.conf pasted below.

The clients are using Windows 10 and macOS and they must be able to choose connection. I am trying to separate the connections using "leftid" with different subdomains for each connection (e.g. vpn1.example.org, vpn2.example.org).

My solution below works in macOS by matching "Remote ID" with the appropriate "leftid", however I can't get it to work in Windows 10.

I am very grateful to any help or ideas of how I can solve this.


ipsec.conf
--------------
conn %default
  auto=add
  dpdaction=clear
  dpddelay=180s
  eap_identity=%any
  esp=aes256-sha256,aes256-sha1,3des-sha1!
  forceencaps=yes
  ike=aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
  keyexchange=ikev2
  leftcert=cert.pem
  leftsendcert=always
  rightauth=eap-mschapv2
  rightsendcert=never

conn conn1
  left=%any
  leftid=@vpn1.example.org
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightdns=8.8.8.8,8.8.4.4
  rightsourceip=10.10.10.1/24

conn conn2
  left=%any
  leftid=@vpn2.khalili.xyz
  leftsubnet=0.0.0.0/0
  right=%any
  rightid=%any
  rightdns=8.8.8.8,8.8.4.4
  rightsourceip=10.10.10.2/24
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180925/e9fd58ca/attachment-0001.html>