need swanctl server config sample with ios/android native vpn

[b1gcat]

I try to use ios18+ native vpn with psk to connect strongwans server but failed (NO_PROPOSAL_CHOSEN):

someone can give me some help or hints?

the server conf as follows:

connections {

   test2 {
      pools = mypoll
      local_addrs  = 192.168.0.1

      local {
         auth = psk
         id = test1
      }
      remote {
         auth = eap-mschapv2
         eap_id = %any
      }
      children {
         net {
            local_ts  = 10.1.0.0/16

            updown = /usr/local/libexec/ipsec/_updown iptables
            esp_proposals = aes128gcm128-x25519
         }
      }
      version = 2
      send_certreq = no
      proposals = aes128-sha256-x25519
   }
}

secrets {
   eap-test {
      id = test2
      secret = 1234567890
   }

   ike-test2 {
        id = test2
        secret = 1234567890
    }
}

pools {
    mypoll {
        addrs = 192.168.100.10 - 192.168.100.100
    }
}

[tobiasbrunner]

Note that the combination of PSK and EAP is not valid as per RFC 7296. The server has to be authenticated with a certificate (or EAP as well, but that's an extension and not many clients support it) in order to authenticate the client with EAP. So it's possible that the client doesn't support this and doesn't propose EAP authentication. To only use PSK authentication, change remote.auth to psk as well.

If there is actually a problem with the proposals, the log should give you more details on what exactly didn't match.

esp_proposals = aes128gcm128-x25519

Note that the DH group here might be an issue later during Child SA rekeyings. Depends on what the client proposes then.