Project

General

Profile

History

strongSwan User Documentation »

Usable Examples configurations » History » Version 1

Version 1/41 - Next » - Current version
Noel Kuntze, 03.10.2016 00:09
Some sane example configurations with general and usage notes.

Sane Example configurations

Preliminary obligatory notes:
  • These examples follow the Security Recommendations. Follow them. They are there
    for a reason.
  • You can have several conn sections in your ipsec.conf file
  • Your responder (the proper word for "server" in ipsec talk) needs to identify
    and authenticate itself to the initiator (the proper word for "client" in ipsec talk)
    with the apropriate identity. If your initiator wants to talk to "foo.bar.com",
    your responder needs to identify and authenticate itself as foo.bar.com.
  • Credentials are bound to identities. You can not successfully authenticate yourself
    as the identitiy foo.bar.com with a certificate if that certificate is not issued for that
    identity. The identities that a certificate provide are its complete DN and the SAN fields.
  • The used cipher suite must be supported by both sides. Some implementations
    only support weak crypto. Do not make concessions, unless necessary for
  • XAUTH credentials are handled internally as EAP credentials. Both are valid for
    XAUTH, EAP-GTC, EAP-MSCHAPv2 and whatever other cleartext or digest based
    authentication might be implemented in the future.
  • The cipher settings are deliberately ordered by performance.
    appears in front. That should make charon choose faster, but secure ones first.
  • Do not use MD5, DES or 3DES. They are broken.
  • The algorithm your certificate uses and they algorithm the key exchange uses
    do not have anything to do with each other.
  • strongSwan does not implement L2TP.
  • Read the documentation and use the search function.

Roadwarrior scenario

This is an example configuration that provides support for several clients
with several authentication styles.

Site-To-Site-Scenario