You can find the fix here: darwin-racoon-cisco-cert-fix on GitHub Cheers.

And I will also provide a solution to deploy a strongSwan mixed IKEv2IKEv1 server that would work for almost all clients.

After some IRC discussion today, I decided to take a look, and found the culprit.

They are old, and many parts of the configuration set are getting onto the brink of insecurity.

Use Racoon For Cisco Vpn Mac OS X

However, this is still the highest supported configuration set for vpnc -- default IKEv1 client with Network Manager support on Ubuntu, released in 2008(), iOS 8 and earlier, Mac OS X 10.10 and earlier, and many others.

This does not mean that this configuration set will not work on iOS 9 and OS X 10.11, but as they will try their preferred configurations (AES256, SHA512 and modp2048) first, and then many others in between, and finally to our old configurations, this makes the handshake time to be 10-20 second in my case, which is utterly bad.

However, a lot of aforementioned legacy devices also do not support IKEv2, so we need to deploy a mixed IKEv2IKEv1 server to put everything into one server.

An entire self-signed trust environment would mean that a self-signed CA would have to be installed on your client devices (bad) and it is difficult to protect your CA private key from chances of compromise (bad).

If your CAs private key somehow becomes compromised, then an attacker can easily issue certificates for websites that your clients would trust while visiting.

However, you will still need a server certificate that can either be self-signed or purchased.

Therefore, I have chosen to use a purchased and trusted certificate.

My GoGetSSL reseller account allows me to pay 11.25 for a three year PositiveSSL certificate, but you can also get one for free from Lets Encrypt, just follow their certbot-auto instructions and make symbolic links from Lets Encrypt directories to the relevant directories under etcipsec.d.

Make sure that auto-renewal works for Lets Encrypt, otherwise your server may suddenly stop working.

If you use another distribution, or have special requirements with the installation, then you will need to download the source and build it yourself.

For compatibility reasons, the domain hostname your certificate was issued for should be resolved to your server (as observed from the outside, so no CDN in the middle).

We will use this hostname instead of the IP address to configure strongSwan.

In this post, the example will be vpn.ebornet.com, change this to your servers when editing the configuration.

And continue until the wizard finishes -- we still need to change a few adaptor settings.

Make sure that the type of the VPN is set to IKEv2, we use EAP and MS-CHAPv2, make it save your credentials but do not use system login credentials.

If you are still using iOS 8, you need to configure it with a configuration profile, see the documentation for more details.

Use Racoon For Cisco Vpn Manual Builds Of

To use IKEv2 on Ubuntu 16.04 desktop, manual builds of strongSwan and NetworkManager-strongswan are required.

The followed is what I did and finally worked, if it does not work for you (good chances), please skip this part and try IKEv1 instead.

Or maybe you dont need Network Manager like I do, then theres no need of getting strongSwan to work with Network Manager.

Mac Use Racoon For Cisco Vpn