IKEv2 and iOS

While this isn't on Apple Server.app specifically, I suspect the better able to comment on this topic will be experienced that is server admins who follow this forum.

I'm trying to 'upgrade' my working StrongSwan5 IKEv1 configuration such as used with iOS devices and certificate based authentication to use IKEv2 as well / instead. I partly here that I added a config IKEv2 to StrongSwan and I see in the log connection attempts by the client to iOS 9.2.1 and the customer seems to be able to connect partially, but it seems that the customer is the iPhone is for some reason, try to use IKEv2 with the EAP protocol rather than as I hear ordinary IKEv2 with no EAP. An excerpt from the newspaper

2 Mar 12:52:59 ubuntu charon: 02 [CFG] selected peer config "IPSec-IKEv2.

2 Mar 12:52:59 ubuntu charon: 02 [IKE] counterpart requested EAP, unacceptable config

2 Mar 12:52:59 ubuntu charon: 02 [CFG] passage to peers config "IPSec-IKEv2-EAP.

2 Mar 12:52:59 ubuntu charon: 02 [IKE], initiate the EAP_IDENTITY method (id 0x00)

2 Mar 12:52:59 ubuntu charon: 02 [IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, do not use an ESPv3 TFC padding

Right now I'm just using IKEv2 configuration entry manually on the iPhone that is running iOS 9.2.1. I push the parameters in a mobileconfig file. I know that certificates are correct and that they work in mode IKEv1. In theory with plain IKEv2 and certificates, should no use of name of username/password or a pre shared key. While in a mobileconfig there is a flag set no authentication for IKEv2 that is no EAP, there no option for this in the GUI, I wonder if that's the problem, even if the GUI does not all the boxes for a name of user and password.

I entered valid details for remote ID and Local ID.

On the iPhone itself when asking to connect, it appears immediately disconnect without error displayed on the screen of the iPhone, that is when you press the Connect button to turn green, it immediately destroys himself to the presentation which is the disconnected state.

OK, since no one else has responded, and yet I had to fight myself. I think I've made some progress, it looks like iOS 9.2.1 IKEv2 client is despite the lack of options name of user and password still ask for EAP if you create the profile in the GUI. If however you create a mobileconfig with the same so-called settings so it does not ask for EAP and I have with a mobileconfig file managed to establish a successful connection of IKEv2.

(If it is true it is not the first time that I found a bug in the iOS VPN GUI.)

I intend to use only the mobileconfig files to expel these VPN settings anyway in the end but I still need to tweak things as I believe there is still and issue with the leftid option in StrongSwan5 which is supposed to match the LocalID value.

Tags: Servers and Enterprise Software

Similar Questions

  • What is a good VPN for Mac and iOS client?

    I want to identify a strong product of VPN for Mac and iOS.  I want something that is easy to install and maintain, and it's effective.

    Thank you

    This depends a lot on what you're trying to accomplish. Can elaborate you on why you think you need?

  • How to connect the system android and ios?

    my main project is to put a link or for communication between the system android and ios. the controls I should know?

    If you want assistance please provide details as to what you're trying to do.

    Writing an effective question of communities of Apple Support

  • Families can share on android and iOS devices

    Families can share on android and iOS devices?

    If you have a family membership to the Apple's music, you can use Apple music in a family on iOS, Android, Apple TV and iTunes on Mac or PC.

  • Safari and mail app freeze 9.2.1 ios and ios 9.3

    Safari and mail app freeze on my ipad mini 4 (9.2.1 ios and ios 9.3) in these last two days each time if I touch to create a link in the email or on the web page.

    I tried to turn off the power of java script in safari... always gel

  • Japanese English Dictionary on Mac OS x and iOS poster

    For some words, on Mac OS x and iOS dictionary displays definitions and foreign words (Korean?).

    For example, if I type "Cleo", I get this:

    I don't have any installed non-English Dictionary.

    Can someone explain this?

    MacBook Pro OS 10.11.3

    iPhone 6 more iOS 9.2.1

    InternetCloud wrote:

    I don't have any installed non-English Dictionary.

    Have you actually gone to Dictionary.app > Preferences and ensures that only checked boxes are English dictionaries, even after all the way to the bottom of the scrolling list?

  • Orders between IOS and IOS - XE devices?

    Hi all

    Is there a difference in order between IOS and IOS - XE routers?  If Yes, can you please share more details on the same?

    Thank you

    Sunil Kumar

    Hello

    Most of the commands are the same for both IOS and IOS - XE.

    Here's more information:

    http://www.Cisco.com/c/en/us/products/collateral/iOS-NX-OS-software/iOS-...

    HTH

  • ASA (v9.1) VPN from Site to Site with IKEv2 and certificates CEP/NDE MS

    Hi all

    I am currently a problem with VPN Site to Site with IKEv2 and certifiactes as an authentication method.

    Here is the configuration:

    We have three locations with an any to any layer 2 connection. I created each ASA (ASA5510 worm 9.1) to establish one VPN of Site connection to the other for the other two places. Setting this up with pre shared keys and certificates that are signed by the CA MS administrator manually work correctly.

    But when we try to enroll these certificates through the Protocol, CEP/NDE his does not work.

    Here are my steps:

    1 configure the CA Turstpoint to apply to the certification authority

    2. request that the CA through the SCEP protocol works fine

    3. set up a Trustpoint and a pair of keys for the S2S - VPN connection

    4. registration form identity certificate CA via the SCEP Protocol with a one time password works fine

    5. set the trustpoint created as for the S2S - VPN IKEv2 authentication method.

    Now I did it also for the other site of the VPN Tunnel. But when I ping on a host that is on a different location to make appear the Tunnel VPN - the VPN session is not established. In the debugs I see that there are a few problems during authentication of the remote peer.

    On the MS that I see that the certifactes of identity for both ASAs are communicated and not revoked or pending state. The certificate based on the model of the "IPSec (Offline).

    When the CA-Admin and a certificate me manually based on a copy of the model of "Domaincontroller" connection is successfully established.

    So I would like to know which is the correct certificate for IP-Sec peers template to use for the Protocol, CEP and MS Enterprise CA (its server 2008R2 of Microsoft Enterprise)?

    Anyone done this before?

    ASA requires that the local and Remote certificate contains EKU IP Security Tunnel Endpoint (1.3.6.1.5.5.7.3.6) (aka IP Security Tunnel termination). You can create a Microsoft CA model to add.

    If you absolutely must go with the 'bad' cert, there is a command

    ignore-ipsec-keyusage

    but it is obsolete and not recommended.

    Meanwhile at the IETF:

    RFC 4809

    3.1.6.3 extended Key use

    Extended Key Usage (EKU) indications are not required.  The presence

    or lack of an EKU MUST NOT cause an implementation to fail an IKE

    connection.

  • Hi, tell me if the product is adobe to create mobile applications android and ios?

    Hi, tell me if the product is adobe to create mobile applications android and ios?

    Hello

    You can check the following links for Adobe mobile applications development tools

    Mobile application development | Adobe Developer Connection

    Adobe mobile, iPhone, iPad, Android apps | Adobe Creative Cloud

    Android, Android SDK application development | Adobe Developer Connection

  • ISIS nonfunctional routing on the GSS (as well as the JunOS and IOS devices)

    Hello

    I have create a routing configuration that is quite impressive, but I have a strange error.

    As you can see in my schema (also PDF included in the attachment for better resolution) you will see that:

    • the GSS does NOT receive routes announced since the JunOS and IOS devices.
    • the JunOS and IOS devices are to Exchange routes between them
    • the contiguity between the IOS device and JunOS is fine (what is expected if they Exchange routes)
    • the contiguity between IOS / price Juno and the GSS is also very good (but no route of JunOS and IOS are received)
    • OSPF works very well (routes are received to connect by the ESG)


    Does someone experienced this problem front?


    Can someone point me in the right direction?

    ESG-routing-OSPF-ISIS.jpeg

    I have also included the log file when there is no concept of this course are received...

    Thank you

    Hello

    Try to set the metric-style scale

    Cisco:

    conf t

    Router isis

    metric-style scale

    Juniper:

    define isis level 2 scale metric-only protocols

    define isis level 1 scale metric-only protocols

  • How can I change the appearance of the app android and iOS in 2015 DPS?

    How can I change the appearance of the app android and iOS in 2015 DPS? I wouldn't have an option to download a zip with my html/css/js/images property?

    The look & feel for the app is handled through cards & Layouts - and those who are not separated by the platform.

    The look and feel of an article is managed either through the HTML code to the download package as you or pixelated design of InDesign - but these are not separated by the platform.

  • Mac app outlook plugin and iOS?

    Hello

    Will there be a plugin Outlook Mac and iOS app for Adobe send please?

    Thank you

    Karim

    Unfortunately, Outlook on Mac can't stand not plugins. Until Microsoft decides to provide, there is nothing we can do. (As an Outlook Mac user myself, I feel your pain!)

    There are no plans for a follow-up to Send iOS app, but I'll carry this suggestion to the product team.

  • Saving data on Android and iOS?

    I use AIR for Android and iOS and I need the game to save some data for things like: facebook, current level, life, last login time, ID etc...

    What is the best way to do it for Android and iOS?

    Use XML? The code would be as if I had to do for the standard Flash Player?

    Use the sharedobject:

    var so:SharedObject = SharedObject.getLocal ('yourgame','/ ');

    {if (SO. Data.lastcompletedlevel)}

    do all that...

    }

    .

    .

    After completing a level:

    so. Data .lastcompletedlevel = levelNum;

    so. Flush();

  • External swf on Air Android and IOS

    Hello

    Can AIR and IOS android application download and play an external SWF with code inside?

    I created android app AIR (SDK version 4.0) that load an external swf with simple clip on the stage.

    var loader: Loader = new Loader();

    loader.contentLoaderInfo.addEventListener (Event.COMPLETE, onLoaded);

    Loader.Load (new URLRequest ("2.swf"));

    function onLoaded(e:Event):void

    {

    addChild (loader);

    }

    I installed this on device android AIR app but I see no external swf on the stage.

    Thanks in advance

    You must add the external swf file for included files.  and for ios, you must assign the loadercontext property.

  • Android and iOS DRM

    I'm looking to publish an app for iOS and Android.

    I understand not to offer to people like Amazon, insert the DRM to the app. I beieve Google require hard wired before delivery and iOS is similar to Amazon.com.

    Is there a simple document on DRM for a novice, or is it a persopn well informed, willing to share a few ideas?

    The vast majority of my user login information is undertaken as my clients all want-to-business enterprise apps with the exception of the demonstrations of products on itunes. For example, connection systems were already in place. Their users were well pleased and acclimated to the use of the notion of login system. If not, I can't say.

Maybe you are looking for