Static ip for a mobile client

trumee

Hello,

I wanted to specify a static ip address to a mobile client. When using OpenVPN i was able to push an ip address to the client using

ifconfig-push 10.8.8.2 255.255.255.0;

Is there a way to do that in IPSEC?

jimp

VPN > IPsec, Pre-Shared Keys tab, where you setup the key for a user there is a Virtual Address Pool option where you can set a static IP address for a user.

trumee

The Pre-shared keys information is not being used by the android client.

In Pre-Shared keys tab, I created an entry with peer identifier set to an email address (this is what i set in the android client), a random number PSK and a virtual IP of 172.15.0.20/32.
The same email address is what I used as Peer Identifier (User distinguised name) in VPN>IPsec>Mobile Clients>Edit Phase 1. Also, I set a Virtual Address pool of 172.25.0.0/24 in VPN>IPSec>Mobile Clients. The authentication I have setup for Phase 1 is 'Mutual PSK+Xauth'.

Can you clarify how the Pre-Shared Keys entries should match up with the data in VPN>IPsec>Mobile Clients and Phase 1 entries?

jimp

The P1 entries are global for all users. That's typically called something like a group ID or key, or a Pre-Shared Key in clients.

The entries on the PSK tab setup per-user keys used as username/password style entries for IKEv2, which is probably why it's not working for you. xauth users regular users (or RADIUS).

You could try setting a PSK tab entry for the username the user enters, which would be different from their identity, but I haven't tried that.

Pretty much everyone has moved away from xauth to IKEv2, though. I know it isn't supported on Android natively (even on 10), but the strongSwan app works quite well in my experience.

trumee

Ok, I ditched xauth in favor of IKEv2 and now have strongSwan on my Android 10 mobile. I can ping LAN ip addresses and external ips (tried 8.8.8.8) from the mobile, however DNS resolving does not work. I did pass the firewall IP as a DNS server in IPSEC>Mobile Clients settings. On the firewall, I am using DNS Resolver with the following settings,

I specified an ACL for Network which the mobile uses,

In Firewall rules for IPSEC interface I have Any to Any allow all rule for IPV4. In Diagnostic>States, i can see a state from the mobile client to the firewall ip at port 53 with state NO_TRAFFIC:SINGLE and packets 2/0. Any idea why is the firewall not responding to the mobile? Am i missing a route back from the firewall to the mobile?

trumee

This seemed to have helped with the DNS issue.