Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

According to Apple’s support article on VPN for iOS, only Cisco IPSec, Juniper Junos Pulse, and Cisco AnyConnect support the VPN on-demand feature. Are there any open-source implementation (‘free’ as in beer is more important here) of these that I could deploy on a Linux-based system with no special hardware?

Update: I already have a PPTP solution. I am specifically interested in the on-demand features of the other two.

share|improve this question
    
Have you tried running an ipsec gateway on Linux? Might be compatible with the Cisco IPSEC option. Never tried it, though; I use PPTP. –  Steve Dispensa Aug 25 '11 at 15:12
add comment

3 Answers

up vote 10 down vote accepted

Cisco IPSec, Juniper Junos Pulse, and Cisco AnyConnect can be configured for VPN on-demand for certain destination hosts/networks as they are part of the route and can realize the need to establish a VPN connection first in order to connect to those hosts/networks;

So in case of your Linux based PPTP VPN server, as far as that server is not your default routing gateway, VPN on Demand is meaningless. In this configuration your server should be a Cisco IPSEC compatible Gateway on linux and your iOS devices' default routing gateway too.

In case of Apple iOS device, VPN on Demand allows iOS device to establish a transparent and secure connectivity to a remote enterprise network with no more manual configuration at user side.

This VPN on Demand feature cannot be manually configured on the iOS device and requires a certificate-based authentication and is currently supported on Cisco IPSec, Juniper Junos Pulse, and Cisco AnyConnect.

In order to activate and configure it on iOS devices, you must create a configuration profile and then provision the device.

Another form of VPN on Demand is available on Mac OSX devices where Safari decides to establish a VPN connection to connect to certain domains/networks (e.g. vpn.mycompany.com) that you have already listed as VPN on Demand and configured its connection settings profile (password/certificate).

More Info:

iOS VPN on Demand: http://www.0x8847.net/2010/07/iphone-os-vpn-on-demand/ http://manuals.info.apple.com/en_US/Enterprise_Deployment_Guide.pdf

OSX VPN on Demand: http://docs.info.apple.com/article.html?path=Mac/10.6/en/15575.html

For a Cisco IPSec Gateway on Linux, I recommend you use Open source package StrongSwan for your iOS VPN on Demand

http://www.strongswan.org/

Use --enable-cisco-quirks parameter to build StrongSwan to make it compatible with Cisco IPSEC. It is a stable certification based, IPsec Gateway on linux that is compatible with iOS VPN on Demand requirements.

Check following link for setup iOS on StrongSwan:

http://wiki.strongswan.org/projects/strongswan/wiki/IOS_(Apple)

Authentication uses XAUTH and certificates (authby=xauthrsasig).The described setup has been tested and confirmed working on an iPad 2 with iOS 4.3.1, but is expected to work on all other iOS devices (iPhone, iPad, iPod Touch) running an up to date iOS version.

share|improve this answer
add comment

As already mentioned in @Reza's answer you basically just need a profile to make this work. One thing Reza didn't mention though is the actual question I think you were asking. To make this work on linux you need some sort of IPSec support. There are several tools available that can do this, how to configure several of them is available here:

http://www.ipsec-howto.org/t1.html

I've used Openswan for this myself:

http://www.openswan.org/

Once you get the VPN configuration profile working and setup the realm correctly the iOS device will establish the IPSec tunnel on demand and free beers will be had by all (you're buying!)

share|improve this answer
    
I need IPsec with "certificate based authentication." This is not a listed feature for either of these tools. –  Aeyoun Aug 29 '11 at 0:56
1  
I don't think its listed for Openswan because it is the default. Here is how you can configure it to use certificate authentication: natecarlson.com/2007/07/30/… You can replace XP with iOS in this example. –  polynomial Aug 29 '11 at 1:43
add comment

We use the PPTP Linux package on CentOS, and it works very well for OSX, Windows, and iOS. I know it has its limitations with regards to security, but for most people it is more than adequate.

share|improve this answer
    
here's a decent how to: etherninja.org/?p=47 –  SpacemanSpiff Jun 1 '11 at 18:09
1  
I would think on demand is a feature of the client, more than the concentrator? Worth some more research. –  SpacemanSpiff Jun 1 '11 at 20:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.