From 75686581d208ba4b4263420db169f56083dda52b Mon Sep 17 00:00:00 2001 From: yyamashita Date: Wed, 1 Jul 2026 12:30:02 +0900 Subject: Restore intermediate CA cert, disable IKE fragmentation Android (XREAL Beam Pro) fails to reassemble IKE fragments even though FRAG_SUP is negotiated. IP-level fragmentation (handled by the OS kernel) works better. Removing the intermediate cert broke macOS/iOS. This config: - Sends leaf cert + YE1 intermediate (so any client can verify the chain) - fragment_size=0 disables IKE fragmentation; the 1776-byte IKE_AUTH response is sent as one large UDP packet (OS handles IP fragmentation) Co-Authored-By: Claude Sonnet 4.6 --- vpn/strongswan.conf | 1 + 1 file changed, 1 insertion(+) (limited to 'vpn/strongswan.conf') diff --git a/vpn/strongswan.conf b/vpn/strongswan.conf index eeed46c..e2543a5 100644 --- a/vpn/strongswan.conf +++ b/vpn/strongswan.conf @@ -12,5 +12,6 @@ charon { } } send_vendor_id = no + fragment_size = 0 } include strongswan.d/*.conf -- cgit v1.2.3