strongSwan

h1. strongSwan as TNC Client

The following plugins must activated for strongSwan to take on the role of a TNC Client

h3. Configuration as a TNCCS 2.0 Client with EAP-MD5 password-based client authentication

<pre>

./configure --prefix=/usr --sysconfdir=/etc --disable-pluto --enable-curl

            --enable-eap-tls --enable-eap-ttls --enable-eap-identity --enable-eap-md5

            --enable-eap-tnc --enable-tnc-imc --enable-tnccs-20

</pre>

/etc/strongswan.conf - strongSwan configuration file

<pre>

charon {

  plugins {

    eap-tnc {

      protocol = tnccs-2.0

    }

    tnc-imc {

      preferred_language = de, en

    }

  }

}

</pre>

/etc/ipsec.secrets - strongSwan IPsec secrets file

<pre>

carol@strongswan.org : EAP "Ar3etTnp"

</pre>

/etc/ipsec.conf - strongSwan IPsec configuration file

<pre>

conn home

     leftid=carol@strongswan.org

     leftauth=eap

     right=192.168.0.1

     rightid=@moon.strongswan.org

     rightsubnet=10.1.0.0/16

     auto=add

</pre>

h3. Configuration as a TNCCS 2.0 Client with EAP-TLS certicate-based client authentication

<pre>

./configure --prefix=/usr --sysconfdir=/etc --disable-pluto --enable-curl

            --enable-eap-tls --enable-eap-ttls --enable-eap-identity

            --enable-eap-tnc --enable-tnc-imc --enable-tnccs-20

</pre>

/etc/strongswan.conf - strongSwan configuration file

<pre>

charon {

  plugins {

    eap-tnc {

      protocol = tnccs-2.0

    }

    tnc-imc {

      preferred_language = ru, fr, en

    }

  }

}

</pre>

/etc/ipsec.secrets - strongSwan IPsec secrets file

<pre>

: RSA carolKey.pem "nH5ZQEWtku0RJEZ6"

</pre>

/etc/ipsec.conf - strongSwan IPsec configuration file

<pre>

conn home

     leftcert=carolCert.pem

     leftid=carol@strongswan.org

     leftauth=eap

     right=192.168.0.1

     rightid=@moon.strongswan.org

     rightsubnet=10.1.0.0/16

     auto=add

</pre>

h3. Configuration as a TNCCS 1.1 Client where both VPN Gateway and AAA Server authenticate themselves

<pre>

./configure --prefix=/usr --sysconfdir =/etc --disable-pluto --enable-curl

            --enable-eap-tls --enable-eap-ttls --enable-eap-identity --enable-eap-md5

            --enable-eap-tnc --enable-tnc-imc --enable-tnccs-11

</pre>

/etc/strongswan.conf - strongSwan configuration file

<pre>

charon {

  plugins {

    eap-tnc {

      protocol = tnccs-1.1

    }

  }

}

</pre>

/etc/ipsec.secrets - strongSwan IPsec secrets file

<pre>

carol@strongswan.org : EAP "Ar3etTnp"

</pre>

/etc/ipsec.conf - strongSwan IPsec configuration file

<pre>

conn home

     leftid=carol@strongswan.org

     leftauth=eap

     right=192.168.0.1

     rightid=@moon.strongswan.org

     rightsubnet=10.1.0.0/16

     rightauth=pubkey

     aaa_identity="C=CH, O=Linux strongSwan, CN=aaa.strongswan.org"

     auto=add

</pre>