[strongSwan] Config to make it work with "Use certificate for authentication" L2TP option of windows

2017-10-23 Thread RA
Hi. I was able to configure strongswan + xl2tpd to make windows in-built VPN client connect to it using: 1) Plain L2TP (directly to xl2tpd) 2) L2TP/IPSec with PSK (after creating some IPtables rules for xl2tpd) Now as we know PSK isn't very secure, I intend to use other authentication method pro

[strongSwan] Continuous loss/retransmission using IPv6 in IPv4 tunnel.

2017-10-23 Thread Adam Bishop
I have a road warrior deployment, which works perfectly for IPv4 on all (Windows, Linux, OS X) clients. The tunnel is dual stacked, and hands out a private, nat'd v4 address and a public v6 address. IPv6 traffic though experiences massive loss coming from somewhere. I've tested with iperf in th

Re: [strongSwan] Windows ikev2 conn, eap_identity ignored

2017-10-23 Thread Simon Deziel
Hi Giuseppe, On 2017-10-23 06:56 AM, Giuseppe De Marco wrote: > I faced that there are no attr_sql support on standard Debian 9 packages. Indeed, Debian doesn't provide the plugin you are looking for. In Ubuntu, it is available in the libstrongswan-extra-plugins package. There is a bug [1] about

Re: [strongSwan] Windows ikev2 conn, eap_identity ignored

2017-10-23 Thread Giuseppe De Marco
Hi, I faced that there are no attr_sql support on standard Debian 9 packages. ipsec statusall also prints all the available plugins, having already installed all the available strongswan debian packages. So, on Debian 9 we cannot have more then this: loaded plugins: charon test-vectors ldap pkcs

[strongSwan] Problems with multiple ARP responses using strongswan tunnel

2017-10-23 Thread Roelof Spijker
Hello, I’m using a number of Strongswan tunnels to connect multiple networks. Overall this works fairly well, but I’m having an issue with multiple ARP responses that I’m not expecting. The network looks like this: Net A (10.233.0.0/20) | (10.233.3.14) GWA (123.45.67.89) <===> (98.76.54.32) GW