StrongSWAN for IPSec IKEv2 remote access server

Finding the configuration sweetspot to allow any client to connection is a lenghty and tiresome process, must due to the lack of documentation of the clients and also due to the wast amount of bugs that causes all kinds of weirdness and the needs for workarounds.

Strongswan is an awesome ipsec suite that have as far as I know the best opensource support for IKEv2 which is becomming more and more common and with Apple support it both on mobile and desktop os.

Just a few notes below on my findings that might help others on the way. My background is setting up a ipsec system based on Strongswan supporting a very large userbase with a lot of automation and even wrote a own 2 - factor system integrated on top of everything. Server side auth, client challenge.

OS X 10.11, IOS 8 and never

Certificates
The client never asks for the server certificate if it does not know what to ask for. That means a configuration profile is needed with proper CN set or a public certificate. I would recommend the latter for the ease of deployment.

SplitDNS
Having problem with getting the DNS pushed from the server working? The DNS payload is actually pushed from the server and installed/accepted by the client, check for yourself by running
scutil --dns
..but they are never used. The workaround is to use a configuration profile, with this you even get splitdns so absolutely worth doing.

config snippets from a profile

            <key>DNS</key>

            <dict>

                <key>ServerAddresses</key>

                <array>

                    <string>110.10.11.4</string>

                    <string>110.10.11.5</string>

                </array>

                <key>SearchDomains</key>

                <array>

                    <string>roger.se</string>

                    <string>skjetlein.no</string>

                </array>

                <key>SupplementalMatchDomains</key>

                <array>

                    <string>roger.se</string>

                    <string>skjetlein.no</string>

                </array>

            </dict>

Default encryption proposals os x 10.11

IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

IOS 9

• IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1536, 
• IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024

Microsoft Windows 7 & 8

Windows is a sad story with a dash of the typical Microsoft screw up standards and insane technical implementation.

The out of the box IKEv2, albeit one of the first movers, have some strange behavours that are worth mentioning.

NAT and DH2

works great. But if you change the Diffie Helman group to something else, the client will disconnect after approx 50 minutes. The reason is that windows want to rekey and when using nat, the rekay fails and the client disconnect.

Routing, TS and SA Child

Forget about TS, SA Child. Windows done use the TS and you need to use the capabillity accessible via GUI to set  the following options

• All traffic routed via vpn
• Classfull routing
• No traffic via vpn

Classfull routing is an odditty where the clients sets up a route based on the prefix of the assigned virtual ip. Eg. given an address on the 34.2.3.0 network, a 34.0.0.0/8 route will be installed. Why this? I dont know, but my impression after diggigs through the innards of windows is that this is not only remnants from the modem/ppp time, but is the main vpn framework.

No traffic via VPN forced you the set the routes manually after connecting. Either by running route add commands in shell or using the CMAK package from Microsoft, that will add the routes for you.

Default encryption proposals

• IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024

Microsoft Windows 8.1 & 10

Gettings things running here is much easier  and my prefered method is by deploying a powershell script that creates the vpn profile and sets ut correct routing and auth methods.

Example script

Add-VpnConnection -Name "Workplace" -SplitTunneling -ServerAddress vpn.workplace.ne -AuthenticationMethod Eap -EncryptionLevel Required -TunnelType Ikev2

Add-VpnConnectionRoute -ConnectionName "Workplace" -DestinationPrefix 1.2.3.0/24

Add-VpnConnectionRoute -ConnectionName "Workplace" -DestinationPrefix 2.3.4.0/24

Default encryption proposals

• IKE:3DES_CBC/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:3DES_CBC/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:3DES_CBC/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, 
• IKE:AES_CBC_128/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:AES_CBC_128/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, 
• IKE:AES_CBC_192/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:AES_CBC_192/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:AES_CBC_192/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA1_96/PRF_HMAC_SHA1/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/MODP_1024, 
• IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/MODP_1024