Re: [Swan] Is it possible to not be strict with rightid?

2018-04-26 Thread Xinwei Hong
Thank you Paul. So, seems it cannot be more tolerant if right !=%any. Right? In our case, we do provide both left and right with specific IP. Thanks, Xinwei On Thu, Apr 26, 2018 at 2:01 PM, Paul Wouters wrote: > On Thu, 26 Apr 2018, Xinwei Hong wrote: > > Currently, 'rightid' is default to 'le

Re: [Swan] Is it possible to not be strict with rightid?

2018-04-26 Thread Paul Wouters
On Thu, 26 Apr 2018, Xinwei Hong wrote: Currently, 'rightid' is default to 'left'. However, a lot of time the remote peer software cannot send out correct rightid (e.g. internal private IP was used). When we were using racoon, racoon seems to be more tolerant and works OK when rightid mismatch

[Swan] Is it possible to not be strict with rightid?

2018-04-26 Thread Xinwei Hong
Hi, Currently, 'rightid' is default to 'left'. However, a lot of time the remote peer software cannot send out correct rightid (e.g. internal private IP was used). When we were using racoon, racoon seems to be more tolerant and works OK when rightid mismatches. With pluto, we would have to specifi

Re: [Swan] left/rightsubnets option

2018-04-26 Thread Erik Andersson
Great! Thanks. /Erik On 2018-04-26 05:10, Paul Wouters wrote: On Tue, 24 Apr 2018, Erik Andersson wrote:  (have also tried rightsubnets={192.168.110.0/24 50.50.50.0/24})  Yields the following error in the pluto.log file:  Apr 23 12:42:48.546899: address family inconsistency in this/that  co

Re: [Swan] StrongSwan connectivity problems IKEv2 (Android/Linux)

2018-04-26 Thread bessonov . victor
Tried to add IP to certificate, now the line about it disappeared from logs, although, nothing else happened. Logs from connecting Android or Linux devices are pretty similar: packet from 188.233.186.70:56030: roadwarriors IKE proposals for initial responder: 1:IKE:ENCR=AES_GCM_C_256,AES_GCM_C_128