diff options
| author | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 21:48:03 +0900 |
|---|---|---|
| committer | yyamashita <yyamashita@hetzner.yyamashita.com> | 2026-07-02 21:48:03 +0900 |
| commit | 2854b063b4cea071be2e90eb059fef095c26d9a1 (patch) | |
| tree | df2c009d295d7079e0cdba1b6f665804325614c5 /vpn | |
| parent | 71e307963829e7a4a7f7277829a2a60791747cb2 (diff) | |
Re-enable IKE fragmentation (remove fragmentation=no)
Android 12 IKEv2 may handle IKE-level fragments better than
IP-level fragmentation. iOS was failing with IKE fragmentation
previously (ECDSA cert era) — test if RSA cert + IKE fragmentation
now works for both platforms.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Diffstat (limited to 'vpn')
| -rw-r--r-- | vpn/swanctl.conf.tpl | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/vpn/swanctl.conf.tpl b/vpn/swanctl.conf.tpl index 1455bcf..cfce4b1 100644 --- a/vpn/swanctl.conf.tpl +++ b/vpn/swanctl.conf.tpl @@ -1,7 +1,6 @@ connections { ikev2-eap { version = 2 - fragmentation = no # iOS/macOS/Android 互換の暗号スイート proposals = aes256gcm16-prfsha256-ecp256,aes256-sha256-ecp256,aes256gcm16-prfsha384-ecp384,aes256-sha256-modp2048,aes256-sha1-modp2048 |