I've been struggling with StrongSwan for a couple of days trying to get it do something like Opportunistic encryption. I've read a few places that it should be able to do it, but haven't been able to find any configuration examples.
I want to configure it such that the StrongSwan-server does not authenticate the client but simply lets them create an encrypted connection nomatter who they are. Thus anonymous client authentication.
The clients should, by having the public key of the server, be able to verify that they are connected to the right server.
I.e. if the server acts as a webserver public available, everyone should be able to connect - in case they want to secure the connection they can create an IPSec association first. (The Public key is fetched via DNS)
Or do you know any other IPSec software capable of supporting "anonymous" client connections?