Hi all,
I am having trouble connecting an android device to strongswan in
transport mode.
android works with tunnel mode and certificates
android doesnt work with transport mode and certificates
here is my current config I am using for testing transport mode (working
tunnel mode conf below)
conn host
left=myexternalip
leftcert=mycert
leftsendcert=always
leftauth=pubkey
right=%any
rightid=%any
type=transport
auto=add
rightauth=pubkey
authby=pubkey
error im seeing
from server end:
peer requested virtual IP %any
no virtual IP found, sending INTERNAL_ADDRESS_FAILURE
Jul 22 14:25:50 cerberus charon: 16[IKE] configuration payload
negotiation failed, no CHILD_SA built
Jul 22 14:25:50 cerberus charon: 16[IKE] failed to establish CHILD_SA,
keeping IKE_SA
from android end:
received internal address failure notify, no child sa built
closing ike sa due child sa setup failure
config that works with android device in tunnel mode and x509
certificates thats working below
(removing left subnet, changing type and removing right source ip breaks
the connection ad i cant get in)
conn phones-on
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes
dpdaction=clear
dpddelay=300s
rekey=no
left=%any
leftid=externalip
leftcert=mycert
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightsendcert=always
rightauth=pubkey
authby=pubkey
#rightauth=eap-mschapv2
rightsourceip=10.10.10.0/24
rightdns=8.8.8.8,8.8.4.4
rightsendcert=never
eap_identity=%identity
ike=chacha20poly1305-sha512-curve25519-prfsha512,aes256gcm16-sha384-prfsha384-ecp384,aes256-sha1-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
any ideas?
thankyou :)
--
Lewis Robson
Systems Administrator
