Static ip for a mobile client
I wanted to specify a static ip address to a mobile client. When using OpenVPN i was able to push an ip address to the client using
ifconfig-push 10.8.8.2 255.255.255.0;
Is there a way to do that in IPSEC?
VPN > IPsec, Pre-Shared Keys tab, where you setup the key for a user there is a Virtual Address Pool option where you can set a static IP address for a user.
The Pre-shared keys information is not being used by the android client.
In Pre-Shared keys tab, I created an entry with peer identifier set to an email address (this is what i set in the android client), a random number PSK and a virtual IP of 126.96.36.199/32.
The same email address is what I used as Peer Identifier (User distinguised name) in VPN>IPsec>Mobile Clients>Edit Phase 1. Also, I set a Virtual Address pool of 172.25.0.0/24 in VPN>IPSec>Mobile Clients. The authentication I have setup for Phase 1 is 'Mutual PSK+Xauth'.
Can you clarify how the Pre-Shared Keys entries should match up with the data in VPN>IPsec>Mobile Clients and Phase 1 entries?
The P1 entries are global for all users. That's typically called something like a group ID or key, or a Pre-Shared Key in clients.
The entries on the PSK tab setup per-user keys used as username/password style entries for IKEv2, which is probably why it's not working for you. xauth users regular users (or RADIUS).
You could try setting a PSK tab entry for the username the user enters, which would be different from their identity, but I haven't tried that.
Pretty much everyone has moved away from xauth to IKEv2, though. I know it isn't supported on Android natively (even on 10), but the strongSwan app works quite well in my experience.
Ok, I ditched xauth in favor of IKEv2 and now have strongSwan on my Android 10 mobile. I can ping LAN ip addresses and external ips (tried 188.8.131.52) from the mobile, however DNS resolving does not work. I did pass the firewall IP as a DNS server in IPSEC>Mobile Clients settings. On the firewall, I am using DNS Resolver with the following settings,
I specified an ACL for Network which the mobile uses,
In Firewall rules for IPSEC interface I have Any to Any allow all rule for IPV4. In Diagnostic>States, i can see a state from the mobile client to the firewall ip at port 53 with state NO_TRAFFIC:SINGLE and packets 2/0. Any idea why is the firewall not responding to the mobile? Am i missing a route back from the firewall to the mobile?
This seemed to have helped with the DNS issue.