From 090c4afe8dce25f772c24fc9bb6e3b96d23fcc2b Mon Sep 17 00:00:00 2001
From: Chris Cowart <ccowart@timesinks.net>
Date: Sat, 15 Nov 2025 22:39:53 -0800
Subject: T8027: vpn: adding config for swanctl "send-cert always"

This setting seems to be required for various Apple clients to
connect to the IKEv2 IPSec VPN.
---
 interface-definitions/vpn_ipsec.xml.in | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/vpn_ipsec.xml.in b/interface-definitions/vpn_ipsec.xml.in
index 517bf89fd..7d901402d 100644
--- a/interface-definitions/vpn_ipsec.xml.in
+++ b/interface-definitions/vpn_ipsec.xml.in
@@ -870,6 +870,12 @@
                         <defaultValue>eap-mschapv2</defaultValue>
                       </leafNode>
                       #include <include/auth-local-users.xml.i>
+                      <leafNode name="always-send-cert">
+                        <properties>
+                          <help>Always send local certificate for this connection</help>
+                          <valueless/>
+                        </properties>
+                      </leafNode>
                       <leafNode name="server-mode">
                         <properties>
                           <help>Server authentication mode</help>
-- 
cgit v1.2.3