Versions Compared

Old Version 19

changes.mady.by.user Artūrs C.

Saved on

compared with

New Version 20

changes.mady.by.user Artūrs C.

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA1AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone
SHA1DESnone
SHA1nonenone

macOS client configuration

Open the PKCS12 format certificate file on the macOS computer and install the certificate in the "System" keychain. It is necessary to mark the CA certificate as trusted manually since it is self-signed. Locate the certificate macOS Keychain Access app under the System tab and mark it as Always Trust.

...

Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA256AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone

iOS client configuration

Typically PKCS12 bundle contains also a CA certificate, but iOS does not install this CA, so a self-signed CA certificate must be installed separately using PEM format. Open these files on the iOS device and install both certificates by following the instructions. It is necessary to mark the self-signed CA certificate as trusted on the iOS device. This can be done in Settings -> General -> About -> Certificate Trust Settings menu. When it is done, check whether both certificates are marked as "verified" under the Settings -> General -> Profiles menu.

...

Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
SHA256AES-256-CBCnone
SHA1AES-128-CBCnone
SHA13DESnone


Note

If you are connected to the VPN over WiFi, the iOS device can go into sleep mode and disconnect from the network.

Android (strongSwan) client configuration

Currently, there is no IKEv2 native support in Android, however, it is possible to use strongSwan from Google Play Store which brings IKEv2 to Android. StrongSwan accepts PKCS12 format certificates, so before setting up the VPN connection in strongSwan, make sure you download the PKCS12 bundle to your Android device. When it is done, create a new VPN profile in strongSwan, type in the server IP, and choose "IKEv2 Certificate" as VPN Type. When selecting a User certificate, press Install and follow the certificate extract procedure by specifying the PKCS12 bundle. Save the profile and test the connection by pressing on the VPN profile.

Image Added

It is possible to specify custom encryption settings in strongSwan by ticking the "Show advanced settings" checkbox. Currently, strongSwan by default is compatible with the following Phase 1 ( profiles) and Phase 2 ( proposals) proposal sets:

Phase 1
Hash AlgorithmEncryption AlgorithmDH Group
SHA*AES-*-CBCmodp2048
SHA*AES-*-CBCecp256
SHA*AES-*-CBCecp384
SHA*AES-*-CBCecp521
SHA*AES-*-CBCmodp3072
SHA*AES-*-CBCmodp4096
SHA*AES-*-CBCmodp6144
SHA*AES-*-CBCmodp8192
SHA*AES-*-GCMmodp2048
SHA*AES-*-GCMecp256
SHA*AES-*-GCMecp384
SHA*AES-*-GCMecp521
SHA*AES-*-GCMmodp3072
SHA*AES-*-GCMmodp4096
SHA*AES-*-GCMmodp6144
SHA*AES-*-GCMmodp8192


Phase 2
Hash AlgorithmEncryption AlgorithmPFS Group
noneAES-256-GCMnone
noneAES-128-GCMnone
SHA256AES-256-CBCnone
SHA512AES-256-CBCnone
SHA1AES-256-CBCnone
SHA256AES-192-CBCnone
SHA512AES-192-CBCnone
SHA1AES-192-CBCnone
SHA256AES-128-CBCnone
SHA512AES-128-CBCnone
SHA1AES-128-CBCnone

Linux (strongSwan) client configuration

Download the PKCS12 certificate bundle and move it to /etc/ipsec.d/private directory.

Add exported passphrase for the private key to /etc/ipsec.secrets file where "strongSwan_client.p12" is the file name and "1234567890" is the passphrase.

Code Block
languagebash
: P12 strongSwan_client.p12 "1234567890"

Add a new connection to /etc/ipsec.conf file

Code Block
languagebash
conn "ikev2"
keyexchange=ikev2
ike=aes128-sha1-modp2048
esp=aes128-sha1
leftsourceip=%modeconfig
leftcert=strongSwan_client.p12
leftfirewall=yes
right=2.2.2.2
rightid="CN=2.2.2.2"
rightsubnet=0.0.0.0/0
auto=add

You can now restart (or start) the ipsec daemon and initialize the connection

Code Block
languagebash
$ ipsec restart
$ ipsec up ikev2