Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Strongswan to handle IPsec connections, and need a way to support both Windows (IKEv2) and OS X (IKEv1) clients. I would prefer to use pure IPsec (i.e. avoid having to setup L2TP) unless there's a compelling reason to use L2TP/IPsec.

I know you can configure Strongswan in ipsec.conf to have some connections use IKEv1 whereas some other connections use IKEv2. However, in my case I can't easily setup separate connection configurations for each user because the IP address that they'll connect from won't be known in advance. I just use a single connection configuration for all of our users.

Is it possible to have some users connect via an IKEv1 connection configuration and others via an IKEv2 connection configuration, or setup a single connection configuration that'll handle both IKEv1 and IKEv2 connections? If not, what would be the easiest way to support both Windows and OS X built-in IPsec clients (with Strongswan or some other IPsec package)?

share|improve this question
up vote 3 down vote accepted

Yes, you can do IKEv1 and IKEv2 simultaneously as long as you have both pluto and charon installed and the daemons running. Use this in your config setup:


And use the keyexchange parameters in your ipsec.conf's conn sections:

conn foo

conn bar
share|improve this answer
Thanks. I was aware of that. As stated in the question: "I can't easily setup separate connection configurations for each user because the IP address that they'll connect from won't be known in advance." So how would I setup separate connection sections if I don't know the client's IP address in advance? In other words, how would Strongswan know which connection section to use for a new connection? I'm under the impression that a connection is selected before IKE is used, is that correct? – Alex Sep 15 '13 at 0:05
@Alex Since the connection is made with IKE, either v1 or v2, strongSwan would have no problem selecting the right config. But in releases before 5.x the two daemons will use all configs as responder no matter what value has been set for keyexchange (i.e. that option has no effect for responders, it only affects initiators). Of course, not all configs will actually work with both protocol versions, so it could still be that a config is loaded only by one daemon. Anyway, in current releases (where there is only one IKE daemon) the protocol version is taken into account when selecting configs. – ecdsa Sep 16 '13 at 9:58
I just tested this and you're absolutely correct. Thanks! – Alex Sep 30 '13 at 21:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.