My config:
Phase 1:
- Key exchange version: IKEv2 Internet
- Protocol: IPv4
- Interface: WAN
- Authentification Method: EAP-MSChapv2
- My Identifier: IP-Address
- IP: xxx.xxx.xxx.xxx
- Peer identifier: any
- My certificate: the correct one
- Encryption alghorithm: AES 256bit, SHA 256, DH Group 14
- MOBIKE enabled
- DPD enabled
Phase 2:
- Mode: Tunnel IPv4
- Local Network: Network, 0.0.0.0/0
- NAT translation: None
- Protocol: ESP
- Encryption Alghoritm: AES 256 bits, AES-GCM256 Auto
- Hash Algorithm: SHA256, SHA384, SHA512
Mobile Client:
- Enabled
- User Authentification: Local Database
- Provide a virtual IP address to clients: enabled, 10.169.90.0/24
- Provide a list of accessible networks to clients enabled
Pre-shared key:
- Identifier: mobile
- Type: EAP
- Key: xxxxxxx
Firewall:
- IPsec all open
Phase 2:
Mobile client:
Pre-shared Key:
Firewall:
[if] => mvneta0.4092
[descr] => OPT
[switchif] => switch0.port1
)
[opt2] => Array
(
[descr] => MANAGEMENT
[if] => mvneta0.5
[enable] =>
[ipaddr] => 10.168.5.1
[subnet] => 24
[spoofmac] =>
)
[opt3] => Array
(
[descr] => IOT
[if] => mvneta0.10
[enable] =>
[ipaddr] => 10.168.10.1
[subnet] => 24
[spoofmac] =>
)
[opt4] => Array
(
[descr] => NAS
[if] => mvneta0.20
[enable] =>
[spoofmac] =>
[ipaddr] => 10.168.20.1
[subnet] => 24
)
[opt5] => Array
(
[descr] => VPN
[if] => mvneta0.30
[enable] =>
[ipaddr] => 10.168.30.1
[subnet] => 24
[spoofmac] =>
)
[opt6] => Array
(
[descr] => GUEST
[if] => mvneta0.40
[enable] =>
[ipaddr] => 172.16.40.1
[subnet] => 24
[spoofmac] =>
)
)
[staticroutes] =>
[dhcpd] => Array
(
[lan] => Array
(
[enable] =>
[range] => Array
(
[from] => 10.168.1.1
[to] => 10.168.1.254
)
[dhcpleaseinlocaltime] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
)
[opt2] => Array
(
[range] => Array
(
[from] => 10.168.5.1
[to] => 10.168.5.9
)
[enable] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
[dhcpleaseinlocaltime] =>
[staticmap] => Array
(
[0] => Array
(
[mac] => f0:d5:bf:7d:43:99
[cid] =>
[ipaddr] => 10.168.5.11
[hostname] =>
[descr] => Christoph Laptop - WLAN
[filename] =>
[rootpath] =>
[defaultleasetime] =>
[maxleasetime] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkey] =>
[tftp] =>
[ldap] =>
)
)
)
[opt3] => Array
(
[range] => Array
(
[from] => 10.168.10.11
[to] => 10.168.10.99
)
[enable] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
[dhcpleaseinlocaltime] =>
[staticmap] => Array
(
[0] => Array
(
[mac] => 5c:f3:70:58:ec:c9
[cid] =>
[ipaddr] => 10.168.10.101
[hostname] =>
[descr] => Scanner (Brother)
[filename] =>
[rootpath] =>
[defaultleasetime] =>
[maxleasetime] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkey] =>
[tftp] =>
[ldap] =>
)
)
)
[opt4] => Array
(
[range] => Array
(
[from] => 10.168.20.11
[to] => 10.168.20.99
)
[enable] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
[dhcpleaseinlocaltime] =>
[staticmap] => Array
(
[0] => Array
(
[mac] => 00:11:32:5e:eb:41
[cid] =>
[ipaddr] => 10.168.20.100
[hostname] =>
[descr] => NAS
[filename] =>
[rootpath] =>
[defaultleasetime] =>
[maxleasetime] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkey] =>
[tftp] =>
[ldap] =>
)
)
)
[opt5] => Array
(
[range] => Array
(
[from] => 10.168.30.11
[to] => 10.168.30.99
)
[enable] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
[dhcpleaseinlocaltime] =>
)
[opt6] => Array
(
[range] => Array
(
[from] => 172.16.40.11
[to] => 172.16.40.99
)
[enable] =>
[failover_peerip] =>
[defaultleasetime] =>
[maxleasetime] =>
[netmask] =>
[gateway] =>
[domain] =>
[domainsearchlist] =>
[ddnsdomain] =>
[ddnsdomainprimary] =>
[ddnsdomainsecondary] =>
[ddnsdomainkeyname] =>
[ddnsdomainkeyalgorithm] => hmac-md5
[ddnsdomainkey] =>
[mac_allow] =>
[mac_deny] =>
[ddnsclientupdates] => allow
[tftp] =>
[ldap] =>
[nextserver] =>
[filename] =>
[filename32] =>
[filename64] =>
[rootpath] =>
[numberoptions] =>
[dhcpleaseinlocaltime] =>
)
)
[dhcpdv6] => Array
(
[lan] => Array
(
[enable] =>
[range] => Array
(
[from] => ::1000
[to] => ::2000
)
[ramode] => assist
[rapriority] => medium
)
)
[snmpd] => Array
(
[syslocation] =>
[syscontact] =>
[rocommunity] => public
)
[diag] => Array
(
[ipv6nat] => Array
(
[ipaddr] =>
)
)
[syslog] => Array
(
[filterdescriptions] => 1
)
[nat] => Array
(
[outbound] => Array
(
[mode] => automatic
)
)
[filter] => Array
(
[rule] => Array
(
[0] => Array
(
[type] => pass
[ipprotocol] => inet
[descr] => Default allow LAN to any rule
[interface] => lan
[tracker] => 0100000101
[source] => Array
(
[network] => lan
)
[destination] => Array
(
[any] =>
)
)
[1] => Array
(
[type] => pass
[ipprotocol] => inet6
[descr] => Default allow LAN IPv6 to any rule
[interface] => lan
[tracker] => 0100000102
[source] => Array
(
[network] => lan
)
[destination] => Array
(
[any] =>
)
)
[2] => Array
(
[id] =>
[tracker] => 1630477503
[type] => pass
[interface] => enc0
[ipprotocol] => inet
[tag] =>
[tagged] =>
[max] =>
[max-src-nodes] =>
[max-src-conn] =>
[max-src-states] =>
[statetimeout] =>
[statetype] => keep state
[os] =>
[source] => Array
(
[any] =>
)
[destination] => Array
(
[any] =>
)
[descr] =>
[updated] => Array
(
[time] => 1630477503
[username] => [email protected] (Local Datab ase)
)
[created] => Array
(
[time] => 1630477503
[username] => [email protected] (Local Datab ase)
)
)
[3] => Array
(
[id] =>
[tracker] => 1612988883
[type] => pass
[interface] => opt2
[ipprotocol] => inet
[tag] =>
[tagged] =>
[max] =>
[max-src-nodes] =>
[max-src-conn] =>
[max-src-states] =>
[statetimeout] =>
[statetype] => keep state
[os] =>
[source] => Array
(
[any] =>
)
[destination] => Array
(
[any] =>
)
[descr] => Allow all to all
[updated] => Array
(
[time] => 1612988883
[username] => [email protected] (Local Dat abase)
)
[created] => Array
(
[time] => 1612988883
[username] => [email protected] (Local Dat abase)
)
)
[4] => Array
(
[id] =>
[tracker] => 1613586931
[type] => pass
[interface] => opt3
[ipprotocol] => inet
[tag] =>
[tagged] =>
[max] =>
[max-src-nodes] =>
[max-src-conn] =>
[max-src-states] =>
[statetimeout] =>
[statetype] => keep state
[os] =>
[source] => Array
(
[address] => 10.168.10.101
)
[destination] => Array
(
[network] => opt4
)
[descr] => Allow scanner to NAS
[updated] => Array
(
[time] => 1613586931
[username] => [email protected] (Local Databa se)
)
[created] => Array
(
[time] => 1613586931
[username] => [email protected] (Local Databa se)
)
)