diff options
| author | jim-p <jimp@pfsense.org> | 2015-10-28 13:51:22 -0400 |
|---|---|---|
| committer | jim-p <jimp@pfsense.org> | 2015-10-28 13:51:22 -0400 |
| commit | 76827b9cedc8a816023aa2b882844b883a7fa8c8 (patch) | |
| tree | b0a39962c039a390282c56170b6f4b23c3a1156f /src/etc | |
| parent | ed7f3bbcda1767494e90d779fa92a4d8fcac2524 (diff) | |
| download | pfsense-76827b9cedc8a816023aa2b882844b883a7fa8c8.zip pfsense-76827b9cedc8a816023aa2b882844b883a7fa8c8.tar.gz | |
Set leftsendcert=always for IKEv2 configurations with certificates to better accommodate OS X and iOS manual configurations. Fixes #5353
Diffstat (limited to 'src/etc')
| -rw-r--r-- | src/etc/inc/vpn.inc | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/etc/inc/vpn.inc b/src/etc/inc/vpn.inc index 06da50d..1c22f5f 100644 --- a/src/etc/inc/vpn.inc +++ b/src/etc/inc/vpn.inc @@ -995,6 +995,7 @@ EOD; $authentication .= "leftauth=pubkey\n\trightauth=eap-mschapv2"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; + $authentication .= "\n\tleftsendcert=always"; } } break; @@ -1004,11 +1005,13 @@ EOD; $authentication .= "leftauth=pubkey\n\trightauth=eap-tls"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; + $authentication .= "\n\tleftsendcert=always"; } } else { $authentication = "leftauth=eap-tls\n\trightauth=eap-tls"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; + $authentication .= "\n\tleftsendcert=always"; } } if (isset($casub)) { @@ -1021,11 +1024,13 @@ EOD; $authentication .= "leftauth=pubkey\n\trightauth=eap-radius"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; + $authentication .= "\n\tleftsendcert=always"; } } else { $authentication = "leftauth=eap-radius\n\trightauth=eap-radius"; if (!empty($ph1ent['certref'])) { $authentication .= "\n\tleftcert={$certpath}/cert-{$ph1ent['ikeid']}.crt"; + $authentication .= "\n\tleftsendcert=always"; } } break; |
