0

On a Mac, there is an IKEv2 VPN (Settings, Network, Create, VPN, IKEv2). It requires a server address, account name, password, shared secret and group name.

I am trying to sort out what exactly needs done to create that connection in Ubuntu. I have tried Strongswan and L2TP and cannot get the connection to come up.

I have the following packages installed:

  • strongswan
  • network-manager-strongswan
  • libcharon-extra-plugins

I tried following the steps at https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#ubuntu-linux with substituting the Phase 1 and Phase 2 settings which I ready directly from the VPN server (aes-sha-modp1024 for both phases), confirmed the lifetimes for the phases are correct, tried with "Enforce UDP encapsulation" enabled and disabled, and tried with "Use IKEv2 key exchange" enabled and disabled.

I reviewed the output from journalctl --no-hostname --unit=NetworkManager | tail -100.

The output included in part, [IKE] received NO_PROPOSAL_CHOSEN error notify. So back to checking the Phase 1 and Phase 2 algorithms. I confirmed they are correct based on the settings in the VPN server and Strongswan's IKEv1 Cipher Suites documentation (https://wiki.strongswan.org/projects/strongswan/wiki/IKEv1CipherSuites). I tried setting the algorithms as aes-sha-modp1024 and aes-sha-modp1024!.

Thank you in advance.

Update 1 - My question is almost identical to this question Where to add the Pre-Shared Key for the Server Authentication with Network Manager for L2TP/IPSEC? but it looks like in that thread, an answer was removed that may have contained useful information.

  • An answer that has correct and valuable info is not removed by the Mods. If you think you saw something and now it is not there the person who posted the answer removed it. – David Apr 07 '23 at 08:25
  • Although network-manager-l2tp has a "Use IKEv2 key exchange" checkbox, it is not intended to be used for pure IPsec IKEv2 VPN servers that don't use L2TP. As far as I'm aware, there are no commercial L2TP servers that use IKEv2. aes-sha-modp1024 is not supported by strongswan IKEv2 as it is considered too weak and deprecated for security reasons, for legacy reasons, strongswan will supports it when using IKEv1 – Douglas Kosovic Apr 26 '23 at 22:35

0 Answers0