Hot answers tagged ipsec
Use a dynamic DNS service. Get a hostname for each site. configure VPN connections to use hostname for each connection instead of the sites IP address (Since you said its dynamic and subject to change) The dynamic DNS service should come with an application that monitors for an IP address change, and updates the hostname record automatically.
I had an identical problem and solved it by ensuring I had the certificate chain in the certificate file (end-entity cert, intermediate CA, root CA - in that order). TLS is fun. After restarting strongSwan, this stopped working, but started working again when I dropped the intermediate and root CA into /etc/ipsec.d/cacerts.
Only top voted, non community-wiki answers of a minimum length are eligible