<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto">On May 1, 2021, at 10:39, Blue Aquan <blueaquan@zuwissen.com> wrote:<br><div dir="ltr"><blockquote type="cite"><br></blockquote></div><blockquote type="cite"><div dir="ltr"><div><font size="4"><br></font></div><div><font size="4">Hi Paul</font></div><div><font size="4"> I read a few documentation about similar problem with MacOS and tried a suggestion you have mentioned in them. I didn't import a profile, but in the VPN configuration of Mac, under "Authentication Settings", I choose "None". When I select "None", it throws up two options below "Shared Secret" and "Certificate"... I choose "Certificate" and selected the corresponding client certificate and applied the change. </font></div><div><font size="4"><br></font></div><div><font size="4">When I did this, it still does not connect, but there's a change in the message from the previous one</font></div></div></blockquote><div><br></div><div>I haven’t tried lately without using mobileconfig configuration files. The method you describe used to work.</div><div><br></div><br><blockquote type="cite"><div dir="ltr"><div><font size="4"><br></font></div><div><font size="4">May 1 19:55:55.592575: "MOBILE"[1] 1.2.3.4 #8: processing decrypted IKE_AUTH request: SK{IDi,N,N,IDr,AUTH,CERT,CP,N,N,SA,TSi,TSr}</font></div></div></blockquote><br><blockquote type="cite"><div dir="ltr"><div><span style="font-size: large;">May 1 19:55:55.596196: "MOBILE"[2] 1.2.3.4 #8: authenticated using RSA with SHA1</span></div></div></blockquote><div><br></div><div>So this is better. Now you are authenticated so it’s no longer trying to do EAP.</div><br><blockquote type="cite"><div dir="ltr"><div><font size="4">May 1 19:55:55.611645: "MOBILE"[2] 1.2.3.4 #9: responding to IKE_AUTH message (ID 1) from 1.2.3.4:4500 with encrypted notification TS_UNACCEPTABLE</font></div></div></blockquote><div><br></div><div>It looks like the client wasn’t sending 0/0 to 0/0 to allow the server to narrow it to a single IP ?</div><div><br></div><div>Note on this older one</div><div><br></div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><div><span style="font-size: large;">May 1 13:52:38.412735: "MOBILE"[1] 1.2.3.4 #10: dropping unexpected IKE_AUTH message containing INITIAL_CONTACT... notification; message payloads: SK; encrypted payloads: SA,IDi,IDr,N,TSi,TSr,CP; missing payloads: AUTH</span></div></blockquote></div></blockquote><div><br></div><div>Missing AUTH is a sign of the client trying EAP. That is currently not supported with libreswan.</div><div><br></div><div><br></div><br><blockquote type="cite"><div dir="ltr"><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><blockquote type="cite" style="margin:0 0 0 .8ex; border-left:2px #729fcf solid;padding-left:1ex"><pre>conn COMET</pre><pre> left=1.2.3.4</pre><pre> leftsubnet=192.168.1.0/24</pre><pre> leftcert=sun.abc.com</pre><pre> </pre></blockquote></blockquote></blockquote></div></blockquote><div>Assuming you have rightaddrrsspool, it seems your Mac client doesn’t have 192168.1.0/24 (or 0.0.0.0/0) configured but something else ?</div><div><br></div><div>Paul</div></body></html>