N
N
nordz0r2021-10-19 16:21:34
Debian
nordz0r, 2021-10-19 16:21:34

How to specify in Windows RemoteID for IKEv2 connection?

Good afternoon. I'm trying to set up a connection to a VPN server on StrongSWAN. The config splits users into 2 servers by DNS name (different access for VPN). On the iPhone, there is a remoteid parameter, according to which the desired config clings, but Windows clients always cling to the first one. How is it possible to pass the desired remoteID ?

Debian 10 system
strongswan config /etc/ipsec.conf

config setup
    charondebug = "ike 1, knl 0, cfg 0"
    uniqueids = never

conn swan.domain.ru
    auto = add
    compress = no
    type = tunnel
    keyexchange = ikev2
    fragmentation = yes
    forceencaps = yes
    dpdaction = clear
    dpddelay = 300s
    rekey = no
    left = %defaultroute
    leftid = @swan.domain.ru
    leftcert = /etc/letsencrypt/live/swan.domain.ru/fullchain.pem
    leftsendcert = always
    leftsubnet = 0.0.0.0/0
    right = %any
    rightid = %any
    rightauth = eap-radius
    #rightauth = eap-mschapv2
    rightsourceip = 10.18.20.0/24
    rightdns = 10.18.18.10
    rightsendcert = never
    eap_identity = %identity
    ike = aes256-sha256-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024!
    esp = aes256-sha256,aes128-sha1,3des-sha1!
    dpdaction = restart

conn s35.domain.ru
    auto = add
    compress = no
    type = tunnel
    keyexchange = ikev2
    fragmentation = yes
    forceencaps = yes
    dpdaction = clear
    dpddelay = 300s
    rekey = no
    left = %defaultroute
    leftid = @s35.domain.ru
    leftcert = /etc/letsencrypt/live/s35.domain.ru/fullchain.pem
    leftsendcert = always
    leftsubnet = 10.18.18.101/32, 10.18.18.10/32
    right = %any
    rightid = %any
    rightauth = eap-radius
    #rightauth = eap-mschapv2
    rightsourceip = 10.18.22.0/24
    rightdns = 10.18.18.10
    rightsendcert = never
    eap_identity = %identity
    ike = aes256-sha256-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024!
    esp = aes256-sha256,aes128-sha1,3des-sha1!
    dpdaction = restart

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question