<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">Marc-Christian,<br>
<br>
Apparently this does not apply to the iPhone and a cisco ipsec
mode. However between Cisco IOS
<pre><font size="5"><b><a name="
PRODUCT: GNU Radius Version 1.6.1
OpenCA PKI Version 1.5.0 (modified by the author)
Cisco IOS Version 15.1(4)M4, RELEASE SOFTWARE (fc1)
Shrew VPN Client Version 2.2.1-release (modified by the author)">Version 15.1(4)M4, RELEASE SOFTWARE (fc1)</a></b></font></pre>
and Shrew in PSK mode, I have explicitly set Shrew running with <b>Mutual
PSK + XAuth</b> with a local identifier being a KeyID and the
remote identifier being an FQDN. With this Cisco IOS version,
aggressive mode has to be set while for PSK authentication.<br>
<pre class="moz-signature" cols="72">Philippe Vouters (Fontainebleau/France)
URL: <a class="moz-txt-link-freetext" href="http://vouters.dyndns.org/">http://vouters.dyndns.org/</a>
SIP: <a class="moz-txt-link-abbreviated" href="mailto:sip:Vouters@sip.linphone.org">sip:Vouters@sip.linphone.org</a></pre>
On 03/28/2014 04:33 PM, Marc-Christian Petersen wrote:<br>
</div>
<blockquote cite="mid:53359630.5090108@gmx.de" type="cite">
<pre wrap="">Hi Paul,
yep, I know about the bug but it doesn't happen here.
for whatever reason iOS is using hybrid mode when using
cisco ipsec mode with group name and PSK.
Maybe the problem is Libreswan not offering XAUTH when in
aggressive mode and iOS is falling back to hybrid?
Am 28.03.2014 um 16:25:33 Uhr schrieb Paul Wouters <a class="moz-txt-link-rfc2396E" href="mailto:paul@nohats.ca"><paul@nohats.ca></a>:
</pre>
<blockquote type="cite">
<pre wrap="">On Fri, 28 Mar 2014, Marc-Christian Petersen wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Libreswan does not support Hybrid mode:
Mar 28 16:04:51 vpn pluto[28426]: "XAUTH-GROUP"[2] 1.2.3.4 #2: Pluto does not support HybridInitRSA authentication. Attribute OAKLEY_AUTHENTICATION_METHOD
</pre>
</blockquote>
<pre wrap="">
The iphone should not be using hybrid mode. Be aware if you switch from
PSK to CERT configurations on your iphone, and you don't wipe the
PSK/ID information, your CERT connection will fail.
</pre>
</blockquote>
<pre wrap="">_______________________________________________
Swan mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Swan@lists.libreswan.org">Swan@lists.libreswan.org</a>
<a class="moz-txt-link-freetext" href="https://lists.libreswan.org/mailman/listinfo/swan">https://lists.libreswan.org/mailman/listinfo/swan</a>
</pre>
</blockquote>
<br>
</body>
</html>