From af7c0311b89656198e00ded91c1a2a87f34c331b Mon Sep 17 00:00:00 2001
From: jim-p <jimp@pfsense.org>
Date: Thu, 12 Apr 2018 12:19:44 -0400
Subject: [PATCH] For IPsec mobile clients, write out a more specific
 ipsec.secrets line to help clients find the right key with strongSwan's new
 lookup code. Fixes #8426

---
 src/etc/inc/vpn.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/etc/inc/vpn.inc b/src/etc/inc/vpn.inc
index ab071e4dc6..a970e9b569 100644
--- a/src/etc/inc/vpn.inc
+++ b/src/etc/inc/vpn.inc
@@ -714,6 +714,7 @@ EOD;
 				if (!empty($ph1ent['pre-shared-key'])) {
 					$pskconf .= "{$myid} {$peerid} : PSK 0s" . base64_encode(trim($ph1ent['pre-shared-key'])) . "\n";
 					if (isset($ph1ent['mobile'])) {
+						$pskconf .= "{$myid} %any : PSK 0s" . base64_encode(trim($ph1ent['pre-shared-key'])) . "\n";
 						$pskconf .= " : PSK 0s" . base64_encode(trim($ph1ent['pre-shared-key'])) . "\n";
 					}
 				}