strongSwan EAP Configuration with Passwords

Connection Definition

The following eap connection definition in swanctl.conf allows multiple Windows clients to connect to the strongSwan VPN gateway via any EAP method over IKEv2.

connections {
  eap {
    pools = ipv4, ipv6

    local {
      auth = pubkey
      certs = gatewayCert.pem
      id = vpn.strongswan.org
    }
    remote {
      auth = eap-dynamic
      eap_id = %any
    }
    children {
      eap {
        local_ts = 0.0.0.0/0, ::/0
      }
    }
  }
}

pools {
  ipv4 {
    addrs = 10.10.1.64/26
    dns = 10.10.0.1
  }
  ipv6 {
    addrs = 2a02:168:4407:1::/122
  }
}

aes256-sha256-modp2048 for IKE and aes256-sha1-modp2048 for ESP are the strongest proposals the Windows client is able to offer unless PowerShell is used. These proposals are not explicitly configured here to accept stronger algorithms proposed by such and other clients via strongSwan’s default proposals.

pools = ipv4, ipv6

The gateway assigns an IPv4 and and IPv6 virtual IP address from the pools ipv4 and ipv6 pools, respectively. These two pools are defined in a separate pools section. The IPv4 and IPv6 lease ranges are 10.10.1.64/26 and 2a02:168:4407:1::/122, respectively. An internal IPv4 DNS server 10.10.0.1 is defined as well. The assigned virtual IP addresses and internal DNS server information will be sent to the Windows Client via the IKEv2 Configuration Payload (CP).

local.certs = gatewayCert.pem

The X.509 certificate of the VPN gateway is stored in the /etc/swanctl/x509 directory. The matching private key of the VPN gateway can either be of type RSA or ECDSA and is stored in the corresponding subdirectory in /etc/swanctl/.

local.id = vpn.strongswan.org

The IKEv2 ID of the VPN gateway. It must be contained as a subjectAltName in the gateway certificate.

remote.auth = eap-dynamic

The eap-dynamic plugin allows any EAP-method defined in the strongswan.conf to be negotiated.

charon-systemd {
  plugins {
    eap-dynamic {
      prefer_user = yes
      preferred = tls, mschapv2
    }
  }
}

By default the strongSwan gateway requests EAP-TLS but the Windows client can reply with an EAP-NAK message and request EAP-MSCHAPv2 instead.

remote.eap_id = %any

This option activates the sending of an EAP identity with which the Windows client can be identified. With EAP-TLS, Windows sends its current IP address as an IKEv2 ID which if it is dynamic doesn’t have any identification value.

children.eap-tls.local_ts = 0.0.0.0/0, ::/0

All IPv4 and IPv6 traffic will be tunneled from the Windows client to the strongSwan VPN gateway (no split-tunneling use case).

EAP Secrets

User secrets needed for EAP-MSCHAPv2-based authentication can be stored in the the secrets section of swanctl.conf

secrets {
  eap-andi {
    id = andi
    secret = AznHu5Um?
  }
}