<div dir="ltr"><br clear="all"><div>I am running Libreswan 3.14rc1 on CentOS 7.1.1503 with all updates applied. This environment is only being used as a dev/test/proof-of-concept environment, and is not being exposed to the Internet. SELinux and iptables have been turned off.</div><div><br></div><div>My goal is to start using the Apple provided Personal VPN API to programmatically control the VPN from within an application running on iOS 8.3. It should be noted that this is a different VPN client than the built in Cisco VPN IPSEC client. For Xcode developers, this is part of the NetworkExtension bundle.<br><br>I am able to connect to the VPN server with a variety of methods, but when I attempt to connect from within my application with the Personal VPN API, I get the following message on the server side:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div>initial Aggressive Mode message from 10.1.0.4 but no (wildcard) connection has been configured with policy PSK+AGGRESSIVE+IKEV1_ALLOW</div></blockquote><div><br></div><div>This is my server side configuration:</div><div><br></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">conn RoadWarriors-ikev1-aggr-psk<br> authby=secret<br> aggrmode=yes<br> auto=add<br> rekey=no<br> pfs=no <br> left=10.1.0.1<br> leftid=@<a href="http://10.1.0.1">10.1.0.1</a><br> leftsubnet=<a href="http://0.0.0.0/0">0.0.0.0/0</a><br> rightaddresspool=10.1.0.10-10.1.0.254<br> right=%any<br> modecfgdns1=10.1.0.1<br> leftxauthserver=yes<br> rightxauthclient=yes<br> leftmodecfgserver=yes<br> rightmodecfgclient=yes<br> modecfgpull=yes<br> xauthby=alwaysok<br> dpddelay=30<br> dpdtimeout=120<br> dpdaction=clear<br> ike-frag=yes<br> ikev2=never</blockquote><div><br></div><div><br></div><div>When I check ipsec status, it seems like the policy should handle this:</div><div>
<p class=""><span class="">000 "RoadWarriors-ikev1-aggr-psk": policy: PSK+ENCRYPT+TUNNEL+DONT_REKEY+XAUTH+MODECFG_PULL+AGGRESSIVE+IKEV1_ALLOW+SAREF_TRACK+IKE_FRAG_ALLOW;</span></p></div><div>For reference, the full set of connection logs are:</div><div><br></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px">Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: received Vendor ID payload [FRAGMENTATION 80000000]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: received Vendor ID payload [RFC 3947]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-08]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-07]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-06]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-05]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-04]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-03]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: ignoring Vendor ID payload [draft-ietf-ipsec-nat-t-ike-02_n]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: received Vendor ID payload [Dead Peer Detection]<br>Jun 9 02:41:43 vpnserver pluto[4733]: packet from <a href="http://10.1.0.4:500">10.1.0.4:500</a>: initial Aggressive Mode message from 10.1.0.4 but no (wildcard) connection has been configured with policy PSK+AGGRESSIVE+IKEV1_ALLOW</blockquote><div><br></div><div>Google does not seem to have any answers, nor does the man page for ipsec.conf. A look in the source code does not turn up anything obvious either. Is there something I am missing in the configuration?</div><div><br></div><div>..Ch:W..</div></div>