Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been struggling with StrongSwan for a couple of days trying to get it do something like Opportunistic encryption. I've read a few places that it should be able to do it, but haven't been able to find any configuration examples.

I want to configure it such that the StrongSwan-server does not authenticate the client but simply lets them create an encrypted connection nomatter who they are. Thus anonymous client authentication.

The clients should, by having the public key of the server, be able to verify that they are connected to the right server.

I.e. if the server acts as a webserver public available, everyone should be able to connect - in case they want to secure the connection they can create an IPSec association first. (The Public key is fetched via DNS)

Or do you know any other IPSec software capable of supporting "anonymous" client connections?

share|improve this question

have you tried using pubkey authentication and distribute one private-public key pair (made for this purpose) to all potential clients? they already need to get server public key for verification somewhere, so why not the "anonymous" keypair.

check the uniqueids=no/never option in ipsec.conf and config section.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.