<html dir="ltr"><head></head><body style="text-align:left; direction:ltr;" bgcolor="#ffffff" text="#2e3436" link="#2a76c6" vlink="#2e3436"><div>Hi Team Libreswan</div><div> I have a Libreswan 4.3 (netkey) running on CentOS 8 which has a roadwarrior setup with the following configuration. All through I followed this guide <a href="https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2">https://libreswan.org/wiki/VPN_server_for_remote_clients_using_IKEv2</a> </div><div>With a Linux client, the setup works flawlessly, but I am unable to replicate the same on a Mac client. I tried following the same step by creating a certificate for the Mac client, but the Mac client throws up a lot of errors. I want to know if there's any standard procedure to follow while connecting from a Mac client...? </div><div><br></div><div>On a Linux, the same procedure works perfectly fine </div><div><br></div><div><b>On VPN Server</b></div><div><br></div><div>conn COMET</div><div> left=1.2.3.4</div><div> leftsubnet=192.168.1.0/24</div><div> leftcert=sun.abc.com</div><div> <a href="mailto:leftid=@sun.abc.com">leftid=@sun.abc.com</a></div><div> leftrsasigkey=%cert</div><div> leftsendcert=always</div><div> right=%any</div><div> rightsubnet=0.0.0.0/0</div><div> rightca=%same</div><div> rightrsasigkey=%cert</div><div> rightid=%fromcert</div><div> auto=add</div><div> dpddelay=60</div><div> dpdtimeout=300</div><div> dpdaction=clear</div><div> ikev2=insist</div><div> fragmentation=yes</div><div> type=tunnel</div><div><br></div><div><br></div><div><br></div><div><br></div><div><b>On Linux Client</b></div><div><br></div><div>conn SUN</div><div> left=%defaultroute</div><div> leftcert=comet.abc.com</div><div> <a href="mailto:leftid=@comet.abc.com">leftid=@comet.abc.com</a></div><div> leftrsasigkey=%cert</div><div> leftsubnet=0.0.0.0/0</div><div> right=1.2.3.4</div><div> rightsubnet=192.168.1.0/24</div><div> <a href="mailto:rightid=@sun.abc.com">rightid=@sun.abc.com</a></div><div> rightrsasigkey=%cert</div><div> ikev2=insist</div><div> rekey=yes</div><div> fragmentation=yes</div><div> mobike=yes</div><div> auto=add</div><div><br></div><div><br></div><div><br></div><div><br></div><div># ipsec auto --up SUN</div><div>181 "SUN" #1: initiating IKEv2 connection</div><div>181 "SUN" #1: sent IKE_SA_INIT request</div><div>182 "SUN" #1: sent IKE_AUTH request {auth=IKEv2 cipher=AES_GCM_16_256 integ=n/a prf=HMAC_SHA2_512 group=MODP2048}</div><div>002 "SUN" #1: certificate verified OK: O=Sun,CN=sun.abc.com</div><div>002 "SUN" #1: IKEv2 mode peer ID is ID_FQDN: <a href="mailto:'@sun.abc.com">'@sun.abc.com</a>'</div><div>003 "SUN" #1: authenticated using RSA with SHA2_512</div><div>002 "SUN" #2: negotiated connection [0.0.0.0-255.255.255.255:0-65535 0] -> [192.168.1.0-192.168.1.255:0-65535 0]</div><div>004 "SUN" #2: IPsec SA established tunnel mode {ESPinUDP=>0x5986144e <0xaced27a0 xfrm=AES_GCM_16_256-NONE NATOA=none NATD=1.2.3.4:4500 DPD=passive}</div><div><br></div><div><br></div><div><br></div><div><br></div><div>Thanks, Best</div><div><br></div><div>BA</div><div></div></body></html>