I’m having trouble connecting to my strongSwan IKEv2 VPN server from Windows 11.
I’m using certificate-based machine authentication with certificates issued by my own CA. I connect directly to the server’s IP address, so I included both DNS:<server_ip> and IP:<server_ip> entries in the server certificate’s Subject Alternative Name (SAN).
The same configuration works fine on a Windows 10 machine, but two different Windows 11 machines fail to connect.
Windows 11 reports either RasClient error 628 or 828. In the strongSwan logs, I can see that the Windows 11 client sends a DELETE message for some reason, and the connection fails.
To rule out an issue specific to certificate-based authentication, I also tested an EAP-MSCHAPv2 connection, but the result was the same.
Interestingly, I tested FortiClient VPN on both Windows 11 machines, and it connects successfully.
Has anyone encountered similar behavior with the built-in Windows 11 IKEv2 VPN client? What could cause Windows 11 to abort the connection when Windows 10 works with the same server configuration?
Linux strongSwan U6.0.1/K6.12.107+deb13-amd64
config setup
charondebug="ike 1, knl 1, cfg 0"
uniqueids=yes
conn Test-vpn
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=no
forceencaps=yes
dpdaction=clear
dpddelay=10s
reauth=no
rekey=yes
ikelifetime=3h
lifetime=1h
unique=replace
left=%any
leftid=1.1.1.1
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=172.16.100.30/32
right=%any
rightid="CN=Client"
rightauth=pubkey
rightca="CN=VPN CA"
rightsourceip=10.10.10.1/32
rightdns=172.16.100.1
ike=aes256-sha256-modp2048,aes128-sha256-modp2048,aes256gcm16-sha256-modp2048!
esp=aes256-sha256-modp2048,aes256gcm16-modp2048,aes128-sha256-modp2048!
18:46:40 vpn charon-custom[88425]: 08[NET] received packet: from 2.2.2.2[412] to 172.16.100.10[500] (544 bytes)
18:46:40 vpn charon-custom[88425]: 08[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]
18:46:40 vpn charon-custom[88425]: 08[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
18:46:40 vpn charon-custom[88425]: 08[IKE] received MS-Negotiation Discovery Capable vendor ID
18:46:40 vpn charon-custom[88425]: 08[IKE] received Vid-Initial-Contact vendor ID
18:46:40 vpn charon-custom[88425]: 08[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
18:46:40 vpn charon-custom[88425]: 08[IKE] 2.2.2.2 is initiating an IKE_SA
18:46:40 vpn charon-custom[88425]: 08[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_2048
18:46:40 vpn charon-custom[88425]: 08[IKE] local host is behind NAT, sending keep alives
18:46:40 vpn charon-custom[88425]: 08[IKE] remote host is behind NAT
18:46:40 vpn charon-custom[88425]: 08[IKE] sending cert request for "CN=VPN CA"
18:46:40 vpn charon-custom[88425]: 08[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ N(CHDLESS_SUP) N(MULT_AUTH) ]
18:46:40 vpn charon-custom[88425]: 08[NET] sending packet: from 172.16.100.10[500] to 2.2.2.2[412] (473 bytes)
18:46:40 vpn charon-custom[88425]: 06[NET] received packet: from 2.2.2.2[15200] to 172.16.100.10[4500] (3536 bytes)
18:46:40 vpn charon-custom[88425]: 06[ENC] parsed IKE_AUTH request 1 [ IDi CERT CERTREQ AUTH N(MOBIKE_SUP) CPRQ(ADDR DNS NBNS SRV ADDR6 DNS6 SRV6) SA TSi TSr ]
18:46:40 vpn charon-custom[88425]: 06[IKE] received cert request for "CN=VPN CA"
18:46:40 vpn charon-custom[88425]: 06[IKE] received 68 cert requests for an unknown ca
18:46:40 vpn charon-custom[88425]: 06[IKE] received end entity cert "CN=Client"
18:46:40 vpn charon-custom[88425]: 06[CFG] looking for peer configs matching 172.16.100.10[%any]...2.2.2.2[CN=Client]
18:46:40 vpn charon-custom[88425]: 06[CFG] selected peer config 'Test-vpn'
18:46:40 vpn charon-custom[88425]: 06[CFG] using certificate "CN=Client"
18:46:40 vpn charon-custom[88425]: 06[CFG] using trusted ca certificate "CN=VPN CA"
18:46:40 vpn charon-custom[88425]: 06[CFG] reached self-signed root ca with a path length of 0
18:46:40 vpn charon-custom[88425]: 06[CFG] checking certificate status of "CN=Client"
18:46:40 vpn charon-custom[88425]: 06[CFG] using trusted certificate "CN=VPN CA"
18:46:40 vpn charon-custom[88425]: 06[CFG] crl correctly signed by "CN=VPN CA"
18:46:40 vpn charon-custom[88425]: 06[CFG] crl is valid: until May 12 12:22:33 2027
18:46:40 vpn charon-custom[88425]: 06[CFG] using cached crl
18:46:40 vpn charon-custom[88425]: 06[CFG] certificate status is good
18:46:40 vpn charon-custom[88425]: 06[IKE] authentication of 'CN=Client' with RSA signature successful
18:46:40 vpn charon-custom[88425]: 06[IKE] peer supports MOBIKE
18:46:40 vpn charon-custom[88425]: 06[IKE] authentication of '1.1.1.1' (myself) with RSA signature successful
18:46:40 vpn charon-custom[88425]: 06[IKE] sending end entity cert "CN=1.1.1.1"
18:46:40 vpn charon-custom[88425]: 06[IKE] peer requested virtual IP %any
18:46:40 vpn charon-custom[88425]: 06[CFG] reassigning offline lease to 'CN=Client'
18:46:40 vpn charon-custom[88425]: 06[IKE] assigning virtual IP 10.10.10.1 to peer 'CN=Client'
18:46:40 vpn charon-custom[88425]: 06[IKE] peer requested virtual IP %any6
18:46:40 vpn charon-custom[88425]: 06[IKE] no virtual IP found for %any6 requested by 'CN=Client'
18:46:40 vpn charon-custom[88425]: 06[IKE] IKE_SA Test-vpn[20] established between 172.16.100.10[1.1.1.1]...2.2.2.2[CN=Client]
18:46:40 vpn charon-custom[88425]: 06[IKE] scheduling rekeying in 9787s
18:46:40 vpn charon-custom[88425]: 06[IKE] maximum IKE_SA lifetime 10327s
18:46:40 vpn charon-custom[88425]: 06[CFG] selected proposal: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ
18:46:40 vpn charon-custom[88425]: 06[IKE] CHILD_SA Test-vpn{12} established with SPIs cbffe588_i d8d9e342_o and TS 172.16.100.30/32 === 10.10.10.1/32
18:46:40 vpn charon-custom[88425]: 06[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH CPRP(ADDR DNS DNS) SA TSi TSr N(MOBIKE_SUP) N(ADD_6_ADDR) ]
18:46:40 vpn charon-custom[88425]: 06[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (2112 bytes)
18:46:41 vpn charon-custom[88425]: 09[NET] received packet: from 2.2.2.2[15200] to 172.16.100.10[4500] (80 bytes)
18:46:41 vpn charon-custom[88425]: 09[ENC] parsed INFORMATIONAL request 2 [ D ]
18:46:41 vpn charon-custom[88425]: 09[IKE] received DELETE for ESP CHILD_SA with SPI d8d9e342
18:46:41 vpn charon-custom[88425]: 09[IKE] closing CHILD_SA Test-vpn{12} with SPIs cbffe588_i (0 bytes) d8d9e342_o (0 bytes) and TS 172.16.100.30/32 === 10.10.10.1/32
18:46:41 vpn charon-custom[88425]: 09[IKE] sending DELETE for ESP CHILD_SA with SPI cbffe588
18:46:41 vpn charon-custom[88425]: 09[IKE] CHILD_SA Test-vpn{12} closed
18:46:41 vpn charon-custom[88425]: 09[ENC] generating INFORMATIONAL response 2 [ D ]
18:46:41 vpn charon-custom[88425]: 09[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:46:42 vpn charon-custom[88425]: 16[NET] received packet: from 2.2.2.2[15200] to 172.16.100.10[4500] (80 bytes)
18:46:42 vpn charon-custom[88425]: 16[IKE] received retransmit of request with ID 2, retransmitting response
18:46:42 vpn charon-custom[88425]: 16[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:46:43 vpn charon-custom[88425]: 16[NET] received packet: from 2.2.2.2[15200] to 172.16.100.10[4500] (80 bytes)
18:46:43 vpn charon-custom[88425]: 16[IKE] received message ID 2, expected 3, ignored
18:46:44 vpn charon-custom[88425]: 16[NET] received packet: from 2.2.2.2[15200] to 172.16.100.10[4500] (80 bytes)
18:46:44 vpn charon-custom[88425]: 16[IKE] received message ID 2, expected 3, ignored
18:46:52 vpn charon-custom[88425]: 15[IKE] sending DPD request
18:46:52 vpn charon-custom[88425]: 15[ENC] generating INFORMATIONAL request 0 [ ]
18:46:52 vpn charon-custom[88425]: 15[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:46:56 vpn charon-custom[88425]: 15[IKE] retransmit 1 of request with message ID 0
18:46:56 vpn charon-custom[88425]: 15[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:47:04 vpn charon-custom[88425]: 12[IKE] retransmit 2 of request with message ID 0
18:47:04 vpn charon-custom[88425]: 12[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:47:16 vpn charon-custom[88425]: 02[IKE] retransmit 3 of request with message ID 0
18:47:16 vpn charon-custom[88425]: 02[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:47:36 vpn charon-custom[88425]: 12[IKE] sending keep alive to 2.2.2.2[15200]
18:47:40 vpn charon-custom[88425]: 04[IKE] retransmit 4 of request with message ID 0
18:47:40 vpn charon-custom[88425]: 04[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:47:59 vpn charon-custom[88425]: 09[IKE] sending keep alive to 2.2.2.2[15200]
18:48:19 vpn charon-custom[88425]: 15[IKE] sending keep alive to 2.2.2.2[15200]
18:48:22 vpn charon-custom[88425]: 05[IKE] retransmit 5 of request with message ID 0
18:48:22 vpn charon-custom[88425]: 05[NET] sending packet: from 172.16.100.10[4500] to 2.2.2.2[15200] (80 bytes)
18:48:41 vpn charon-custom[88425]: 02[IKE] sending keep alive to 2.2.2.2[15200]
18:49:01 vpn charon-custom[88425]: 04[IKE] sending keep alive to 2.2.2.2[15200]
18:49:21 vpn charon-custom[88425]: 10[IKE] sending keep alive to 2.2.2.2[15200]
18:49:37 vpn charon-custom[88425]: 06[IKE] giving up after 5 retransmits
18:49:37 vpn charon-custom[88425]: 06[CFG] lease 10.10.10.1 by 'CN=Client' went offline
