Home » Using StrongSwan with smart cards

Configuring gateway Moon

At first, we set up the gateway Moon using a traditional X.509 certificate.

Edit /etc/ipsec.conf

# /etc/ipsec.conf - strongSwan IPsec configuration file

config setup
    crlcheckinterval=180
    strictcrlpolicy=no
    charonstart=no
    plutostart=yes
    plutodebug = all
    plutostderrlog = /var/log/pluto.log

conn %default
    ikelifetime=60m
    keylife=20m
    rekeymargin=3m
    keyingtries=1
    keyexchange=ikev1

conn rw
    left=%defaultroute
    leftcert=moonCert.pem
    leftsubnet=10.1.0.0/16
    leftfirewall=yes
    right=%any
    auto=add

Edit /etc/ipsec.secrets:

# /etc/ipsec.secrets - strongSwan IPsec secrets file

: RSA moonKey.pem

Edit /etc/strongswan.conf:

# /etc/strongswan.conf - strongSwan configuration file

charon {
load = curl test-vectors aes des sha1 sha2 md5 pem pkcs1 gmp random x509 hmac xcbc stroke kernel-netlink updown
}

libstrongswan {
integrity_test = yes
crypto_test {
on_add = yes
}
}

Install Moon RSA key and X.509 certificate:

  • /etc/ipsec.d/certs/moonCert.pem: X.509 certificate.
  • /etc/ipsec.d/private/moonKey.pem: RSA private key.

Restart strongSwan:

$ /etc/init.d/ipsec restart
Bookmark/Search this post with