Skip to content
Register

IKEv2 on Linux—strongSwan documentation drove me to drink

VPS Hosting by lucgone 4 replies 191 views
lucgone

Member OP

Le Baguette

#1

Since 2 days I have make the config for my new VPS on OVHcloud and I want to do IKEv2 for my phone. But the wiki of strongSwan it is... how to say... very complete but not helpful lol

I have try the example config, I have try the wiki page "IKEv2 with EAP", I have try to copy from some blog post from 2019. Every time charon do not start or I have error "no acceptable proposal found". I am not sure what I have make wrong, maybe the certificate? Maybe the left/right syntax?

It is possible to do that with Let's Encrypt or I need self-signed? The doc say both but not when to use which one

If someone have a working config for Debian 12 I take it with pleasure, I have drink two coffee already and it is only 9am

Vive la résistance... électrique
bainangerd

Member

4 #2
lucgone said:
The wiki of strongSwan it is... how to say... very complete but not helpful

The Documentation problem is a known Phenomenon in the Open source ecosystem where the Authors assume deep Familiarity with the Implementation details rather than providing a Working minimal example for the Average administrator who simply wants to establish a SecureTunnel without studying the entire Source code base for three Days which in my Experience is exactly what happened to you and many others before.

Read the source

conn ikev2-eap
    auto=add
    keyexchange=ikev2
    ike=aes256-sha256-modp2048!
    esp=aes256-sha256!
    left=%any
    [email protected]
    leftcert=fullchain.pem
    leftsendcert=always
    right=%any
    rightauth=eap-mschapv2
    eap_identity=%any

Eight Lines. Works. The Source code commentary is the only Truth.

netop_mares

Member

#3

The source is the only truth? That's a bold claim, Gerd.

sofialund

Member

homelab heatstroke

#4

Which EAP method did you try? MSCHAPv2?

hot air, steady hand, magic smoke
DA

Member

#5

Charon not starting, same headache last month

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft