From 090c4afe8dce25f772c24fc9bb6e3b96d23fcc2b Mon Sep 17 00:00:00 2001 From: Chris Cowart Date: Sat, 15 Nov 2025 22:39:53 -0800 Subject: T8027: vpn: adding config for swanctl "send-cert always" This setting seems to be required for various Apple clients to connect to the IKEv2 IPSec VPN. --- data/templates/ipsec/swanctl/remote_access.j2 | 3 +++ 1 file changed, 3 insertions(+) (limited to 'data') diff --git a/data/templates/ipsec/swanctl/remote_access.j2 b/data/templates/ipsec/swanctl/remote_access.j2 index c79f292b4..d06b3d74b 100644 --- a/data/templates/ipsec/swanctl/remote_access.j2 +++ b/data/templates/ipsec/swanctl/remote_access.j2 @@ -8,6 +8,9 @@ proposals = {{ ike_group[rw_conf.ike_group] | get_esp_ike_cipher | join(',') }} version = {{ ike.key_exchange[4:] if ike.key_exchange is vyos_defined else "0" }} send_certreq = no +{% if rw_conf.authentication.always_send_cert is vyos_defined %} + send_cert = always +{% endif %} {% if ike.dead_peer_detection is vyos_defined %} dpd_timeout = {{ ike.dead_peer_detection.timeout }} dpd_delay = {{ ike.dead_peer_detection.interval }} -- cgit v1.2.3