1

On my Debian server I had set up racoon daemon (1:0.8.0-14) for Cisco IPSec VPN using certificates for authentication. My racoon.conf is like following:

log info;
path certificate "/etc/racoon/certs";

listen {
    isakmp $SERVER_IP_HERE [500];
    isakmp_natt $SERVER_IP_HERE [4500];
}

timer {
    natt_keepalive 10 sec;
}

remote anonymous {
    lifetime time 24 hours;
    proposal_check obey;
    passive on;
    exchange_mode aggressive,main;
    my_identifier asn1dn;
    peers_identifier asn1dn;
    verify_identifier on;
    certificate_type x509 "cert_name.crt" "key_name.key";
    ca_type x509 "ca.crt";
    mode_cfg on;
    verify_cert on;
    ike_frag on;
    generate_policy on;
    nat_traversal on;
    dpd_delay 20;
    proposal {
        encryption_algorithm aes;
        hash_algorithm sha1;
        authentication_method xauth_rsa_server;
        dh_group modp1024;
    }
}

mode_cfg {
    conf_source local;

    auth_source system;
    auth_throttle 3;
    save_passwd on;

    dns4 8.8.8.8;
    network4 $SOME_LAN_SUBNET;
    netmask4 255.255.255.0;
    pool_size 128;
}

sainfo anonymous {
    pfs_group 2;
    lifetime time 24 hour;
    encryption_algorithm aes;
    authentication_algorithm hmac_sha1;
    compression_algorithm deflate;
}

I'm not using PSK authentication here. Using iPhone configuration utility I had uploaded all required certificates to iPhone and set up VPN on demand. Everything works just fine except for one thing: iPhone refuses to save VPN password regardless of save_passwd on; in racoon configuration file. As opposed to iPhone behaviour, Mac OS X 10.8.2 have no problems saving password. I had examined iPhone log file and found following:

racoon[151] <Notice>: >>>>> phase change status = phase 1 established
configd[50] <Notice>: IPSec Network Configuration started.
configd[50] <Notice>: IPSec Network Configuration: INTERNAL-IP4-ADDRESS = $SUBNET_IP_HERE.
configd[50] <Notice>: IPSec Network Configuration: INTERNAL-IP4-MASK = 255.255.255.0.
configd[50] <Notice>: IPSec Network Configuration: SAVE-PASSWORD = 0.
configd[50] <Notice>: IPSec Network Configuration: INTERNAL-IP4-DNS = 8.8.8.8.
configd[50] <Notice>: IPSec Network Configuration: BANNER = .
configd[50] <Notice>: IPSec Network Configuration: DEF-DOMAIN = .
configd[50] <Notice>: IPSec Network Configuration: DEFAULT-ROUTE = local-address $SUBNET_IP_HERE/32.
configd[50] <Notice>: IPSec Phase2 starting.
configd[50] <Notice>: IPSec Network Configuration established.
configd[50] <Notice>: IPSec Phase1 established.

Please note IPSec Network Configuration message containing SAVE-PASSWORD = 0.. Is it a bug in racoon daemon on server, or iPhone (iOS version is 6.0.1 (10A523)) or it is me missing something? How to make iPhone remember IPSec VPN password?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.