Hi Houman, > What attributes *should* be in the Disconnect-Request beside User-Name?
None, that's fine. If you receive a NAK that means no IKE_SA was found with a matching remote identity. You should see something like this in the strongSwan log: > received RADIUS DAE Disconnect-Request for houman from 127.0.0.1 > no IKE_SA matches houman, sending Disconnect-NAK Regards, Tobias