strongswan 配置ikev2 for iOS
最新版本的strongswan 目前已支持ikev2 ，对于手机客户端，ios9.0 以上自带的vpn 支持 ikev2(服务器认证方式为：证书，客户端认证方式eap-mschapv2)，安卓部分自带的客户端支持ikev2,如下为支持ios9.0以上的ikev2 配置 （手机客户端个人打包）
修改 ipsec.conf配置文件 vi /etc/ipsec.conf
conn eap_ios
keyexchange=ikev2
ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024!
esp = aes256-sha256,3des-sha1,aes256-sha1!
dpdaction=clear
dpddelay=300s
rekey=no
mobike=yes
fragmentation=yes
#left
left=%any
leftsubnet=0.0.0.0/0
leftauth=psk
leftid=emmdemo.jianq.com
#right
right=%any
rightsourceip=%config
rightauth=eap-mschapv2
rightsendcert=never
eap_identity=%any
auto=add
说明:
keyexchange=ikev2: 指定使用的密钥交换协议是ikev2
ike=aes256-sha256-modp1024,3des-sha1-modp1024,aes256-sha1-modp1024!
上句话指定的是见了第一阶段的加密算法
esp = aes256-sha256,3des-sha1,aes256-sha1!
上句话指定的是第二阶段的加密算法
rekey=no : 服务器对 IOS 发出 rekey 请求会断开连接。
eap_identity=%any : 使用 IOS 的 eap 身份。不然会出现”no eap key found for host <rightid>“错误。
leftauth=psk: 服务器和用户的数据加密方式为共享密钥
rightauth=eap-mschapv2：用户的认证方式为扩展认证方式eap
leftid=emmdemo.jianq.com: IOS 必选要填写的远程服务器ID可以是域名也可以是IP地址
修改ipsec.secrets vi /etc/ipsec.secrets:
: PSK 0s＋base64密码
anruan : EAP "123456"
PSK 数据格式是0s+base64位编码
EAP左右数据分别是用户登录名的密码（字符串）
其他配置文件和ikev1的相同
客户端配置：
客户端使用的配置是个人配置的ikev2支持psk模式的设置脚本
预共享密钥填写PSK后面base64解码后的字符串
远程ID填写leftid后面的内容
本地ID可以忽略
修改strongswan.conf :vi /etc/strongswan.conf
charon {
load_modular = yes
duplicheck.enable = no
compress = yes
dns1 = 8.8.8.8
dns2 = 8.8.4.4
filelog {
/var/log/strongswan.charon.log {
time_format = %b %e %T
default = 2
append = no
flush_line = yes
}
}
修改 charon-logging.conf vi /etc/strongswan.d/charon-logging.conf在这个文件
charon {
# Section to define file loggers, see LOGGER CONFIGURATION in
# strongswan.conf(5).
filelog {
# <filename> is the full path to the log file.
# <filename> {
# Loglevel for a specific subsystem.
# <subsystem> = <default>
# If this option is enabled log entries are appended to the existing
# file.
append = yes
# Default loglevel.
default = 1
# Enabling this option disables block buffering and enables line
# buffering.
# flush_line = no
flush_line=yes
# Prefix each log entry with the connection name and a unique
# numerical identifier for each IKE_SA.
# ike_name = no
ike_name=yes
# Prefix each log entry with a timestamp. The option accepts a
# format string as passed to strftime(3).
# time_format =
time_format=%b %e %T
# }
}
# Section to define syslog loggers, see LOGGER CONFIGURATION in
# strongswan.conf(5).
syslog {
# Identifier for use with openlog(3).
# identifier =
# <facility> is one of the supported syslog facilities, see LOGGER
# CONFIGURATION in strongswan.conf(5).
# <facility> {
# Loglevel for a specific subsystem.
# <subsystem> = <default>
# Default loglevel.
# default = 1
default=1
# Prefix each log entry with the connection name and a unique
# numerical identifier for each IKE_SA.
# ike_name = no
ike_name=yes
# }
}
}