strongSwan

h1. strongSwan as a Policy Enforcement Point

h3. Configuration as a TNCCS 1.1 VPN Policy Enforcement Point with EAP-RADIUS Interface

<pre>

./configure --prefix=/usr --sysconfdir =/etc --disable-pluto --enable-curl

            --enable-eap-radius

</pre>

/etc/strongswan.conf - strongSwan configuration file

<pre>

charon {

  plugins {

    eap-radius {

      secret = gv6URkSs 

      server = 10.1.0.10

      filter_id = yes

    }

  }

}

</pre>

/etc/ipsec.secrets - strongSwan IPsec secrets file

<pre>

: RSA moonKey.pem

</pre>

/etc/ipsec.conf - strongSwan IPsec configuration file

<pre>

conn rw-allow

     rightgroups=allow

     leftsubnet=10.1.0.0/28

     also=rw-eap

     auto=add

conn rw-isolate

     rightgroups=isolate

     leftsubnet=10.1.0.16/28

     also=rw-eap

     auto=add

conn rw-eap

     leftcert=moonCert.pem

     leftid=@moon.strongswan.org

     leftauth=pubkey

     rightauth=eap-radius

     rightid=*@strongswan.org

     rightsendcert=never

     right=%any

</pre>

"PEP logfile":http://www.strongswan.org/uml/testresults/ikev2/rw-eap-tnc-radius/moon.daemon.log

h3. Configuration of a FreeRADIUS Server with TNC@FHH plugin

First build a TNC@FHH-enabled FreeRADIUS Server with two inner authentication methods according to the following "HOWTO":http://trust.inform.fh-hannover.de/wiki/index.php/Howto_build_a_tnc%40fhh-Server_with_two_inner_authentication_methods.