Project

General

Profile

IKEv2 Configuration Examples » History » Version 38

Version 37 (Andreas Steffen, 12.04.2021 14:39) → Version 38/40 (Andreas Steffen, 21.05.2021 12:52)

h1. IKEv2 Configuration Examples

h2. Remote Access

|RSA authentication with X.509 certificates |{{tc_dr(ikev2/rw-cert,IPv4)}} |{{tc(swanctl/rw-cert,IPv4)}} |{{tc(ipv6/rw-ikev2,IPv6)}} |{{tc_dr(ikev2/nat-rw,NAT)}} |{{tc(swanctl/nat-rw,NAT)}} |
|PSK authentication with pre-shared keys (IP) |{{tc_dr(ikev2/rw-psk-ipv4,IPv4)}} |{{tc(swanctl/rw-psk-ipv4,IPv4)}} |{{tc(ipv6/rw-psk-ikev2,IPv6)}}|{{tc_dr(ikev2/nat-rw-psk,NAT)}}| |{{tc(ipv6/rw-psk-ikev2,IPv6)}}|{{tc(swanctl/nat-rw-psk,NAT)}}|
|PSK authentication with pre-shared keys (FQDN) |{{tc_dr(ikev2/rw-psk-fqdn,IPv4)}} (FQDN)|{{tc(swanctl/rw-psk-fqdn,IPv4)}} | | |
|EAP_AKA authentication |{{tc_dr(ikev2/rw-eap-aka-rsa,IPv4)}} |{{tc(swanctl/rw-eap-aka-rsa,IPv4)}} | | |
|EAP_AKA authentication with EAP identity |{{tc_dr(ikev2/rw-eap-aka-id-rsa,IPv4)}} |{{tc(swanctl/rw-eap-aka-id-rsa,IPv4)}} | | |
|EAP_SIM authentication |{{tc_dr(ikev2/rw-eap-sim-rsa,IPv4)}} |{{tc(swanctl/rw-eap-sim-rsa,IPv4)}} | |{{tc_dr(ikev2/rw-eap-sim-radius,RADIUS)}} |{{tc(swanctl/rw-eap-sim-radius,RADIUS)}} |
|EAP_SIM authentication with EAP identity | | |{{tc_dr(ikev2/rw-eap-sim-id-radius,RADIUS)}} |{{tc(swanctl/rw-eap-sim-id-radius,RADIUS)}} |
|EAP_SIM only authentication | | |{{tc_dr(ikev2/rw-eap-sim-only-radius,RADIUS)}} |{{tc(swanctl/rw-eap-sim-only-radius,RADIUS)}} |
|EAP_MSCHAPv2 authentication with EAP identity |{{tc_dr(ikev2/rw-eap-mschapv2-id-rsa,IPv4)}}| |{{tc(swanctl/rw-eap-mschapv2-id-rsa,IPv4)}}| | |
|EAP_MD5 authentication |{{tc_dr(ikev2/rw-eap-md5-rsa,IPv4)}} |{{tc(swanctl/rw-eap-md5-rsa,IPv4)}} | |{{tc_dr(ikev2/rw-eap-md5-radius,RADIUS)}} |{{tc(swanctl/rw-eap-md5-radius,RADIUS)}} |
|EAP_MD5 authentication with EAP identity |{{tc_dr(ikev2/rw-eap-md5-id-rsa,IPv4)}} |{{tc(swanctl/rw-eap-md5-id-rsa,IPv4)}} | |{{tc_dr(ikev2/rw-eap-md5-id-radius,RADIUS)}} |{{tc(swanctl/rw-eap-md5-id-radius,RADIUS)}} |
|EAP_TLS authentication |{{tc_dr(ikev2/rw-eap-tls-only,IPv4)}} |{{tc(swanctl/rw-eap-tls-only,IPv4)}} | |{{tc_dr(ikev2/rw-eap-tls-radius,RADIUS)}} |{{tc(swanctl/rw-eap-tls-radius,RADIUS)}} |
|EAP_TTLS with EAP_MD5 client authentication |{{tc_dr(ikev2/rw-eap-ttls-only,IPv4)}} |{{tc(swanctl/rw-eap-ttls-only,IPv4)}} | |{{tc_dr(ikev2/rw-eap-ttls-radius,RADIUS)}} |{{tc(swanctl/rw-eap-ttls-radius,RADIUS)}} |
|EAP_PEAP with EAP_MD5 client authentication |{{tc_dr(ikev2/rw-eap-peap-md5,IPv4)}} |{{tc(swanctl/rw-eap-peap-md5,IPv4)}} | |{{tc_dr(ikev2/rw-eap-peap-radius,RADIUS)}} |{{tc(swanctl/rw-eap-peap-radius,RADIUS)}} |
|EAP_PEAP with EAP_MSCHAPv2 client authentication|{{tc_dr(ikev2/rw-eap-peap-mschapv2,IPv4)}} authentication |{{tc(swanctl/rw-eap-peap-mschapv2,IPv4)}} | ||

h2. Remote Access with Virtual IP Adresses

| RAM-based server-side virtual IP pool |{{tc_dr(ikev2/ip-pool,IPv4)}} |{{tc(swanctl/ip-pool,IPv4)}} |
| DB-based server-side virtual IP pool |{{tc_dr(ikev2/ip-pool-db,IPv4)}} |{{tc(swanctl/ip-pool-db,IPv4)}} |
| Static server-side virtual IP addresses |{{tc_dr(ikev2/config-payload,IPv4)}} |{{tc(swanctl/config-payload,IPv4)}} |
| Two RAM-based server-side virtual IP pools |{{tc_dr(ikev2/ip-two-pools,IPv4)}} |{{tc(swanctl/ip-two-pools,IPv4)}} |
| Two DB-based server-side virtual IP pools |{{tc_dr(ikev2/ip-two-pools-db,IPv4)}}| |{{tc(swanctl/ip-two-pools-db,IPv4)}} |

h2. Site-to-Site

|RSA authentication with X.509 certificates |{{tc_dr(ikev2/net2net-cert,IPv4)}} |{{tc(swanctl/net2net-cert,IPv4)}} |{{tc(ipv6/net2net-ikev2,IPv6)}} |
|PSK authentication with pre-shared keys |{{tc_dr(ikev2/net2net-psk,IPv4)}} |{{tc(swanctl/net2net-psk,IPv4)}} | |
|Connection setup automatically started by daemon |{{tc_dr(ikev2/net2net-start,IPv4)}} |{{tc(swanctl/net2net-start,IPv4)}} | |
|Connection setup triggered by data to be tunneled|{{tc_dr(ikev2/net2net-route,IPv4)}} tunneled|{{tc(swanctl/net2net-route,IPv4)}} | |

h2. Host-to-Host

|IPsec tunnel mode with X.509 certificates |{{tc_dr(ikev2/host2host-cert,IPv4)}} |{{tc(swanctl/host2host-cert,IPv4)}} |{{tc(ipv6/host2host-ikev2,IPv6)}} |
|IPsec transport mode with X.509 certificates |{{tc_dr(ikev2/host2host-transport,IPv4)}} |{{tc(swanctl/host2host-transport,IPv4)}} |{{tc(ipv6/transport-ikev2,IPv6)}} |

h2. IP Protocol and Port Policies

|IPsec tunnel restricted to ICMP and ssh protocols |{{tc_dr(ikev2/protoport-dual,IPv4)}} |{{tc(swanctl/protoport-dual,IPv4)}} |

h2. Complete List

{{tc_dr(ikev2,All {{tc(swanctl,All IKEv2 test scenarios)}}