ipsec.conf

conn ios
    keyexchange=ikev1
# This was working, but required the local ipsec.secrets file
#    authby=xauthrsasig
#    xauth=server
    left=%defaultroute
    leftsubnet=0.0.0.0/0
    leftfirewall=yes
    leftcert=serverCert.pem
    right=%any
    rightsubnet=172.18.32.0/22
    rightsourceip=172.18.32.0/22
    rightcert=clientCert.pem
    auto=add
# Now I want to do initial pubkey authentication, and follow-up with XAuth to
# the configured RADIUS server.
    rightauth=pubkey
    rightauth2=xauth-radius