StrongswanでIKEv2 EAP 認証でWindowsから接続してみる。

証明書自体は、こちらなどで用意10 Docker Let's Encrypt

シンボリックリンクだけ貼る

cd /etc/strongswan/ipsec.d
ln -s /app/certs/vpn2.kumolabo.com.crt certs/cert.pem
ln -s /app/certs/vpn2.kumolabo.com.key private/privkey.pem
ln -s /app/certs/vpn2.kumolabo.com.chain.pem cacerts/chain.pem

conn %default
    type=tunnel
    authby=psk
    keyingtries=3
    keyexchange=ikev2
    ike=aes256-sha256-modp2048
    esp=aes256-sha256-modp2048
conn IPSec-IKEv2-EAP
    leftsubnet=0.0.0.0/0
    leftid=vpn.hogehoge.com
    left=%any
    leftcert=cert.pem
    leftsendcert=always

    rightid=%any
    right=%any
    rightsourceip=192.168.100.0/24
    rightauth=eap-mschapv2
    eap_identity=%any
    auto=add

下記は、vpnuserを用意した場合。

: RSA privkey.pem
vpnuser : EAP hogehoge

strongswan側に合わせて設定変更

Set-VpnConnectionIPsecConfiguration -ConnectionName "VPN 接続" -AuthenticationTransformConstants SHA256 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup NONE -DHGroup Group14 -Force

> Get-VpnConnection -Name 'VPN'| Select-Object -ExpandProperty IPsecCustomPolicy

AuthenticationTransformConstants : SHA256128
CipherTransformConstants         : AES256
DHGroup                          : Group14
IntegrityCheckMethod             : SHA256
PfsGroup                         : None
EncryptionMethod                 : AES256