Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using Windows 8 client to connect to my new strongswan VPN, and I don't see the option to do preshared keys with IKEv2? Did they leave this feature out?

share|improve this question

closed as off-topic by mfinni, Scott Pack, mdpc, larsks, Ward Jul 26 '13 at 3:40

This question appears to be off-topic. The users who voted to close gave these specific reasons:

  • "Questions must demonstrate a minimal understanding of the problem being solved. Try including attempted solutions, why they didn't work, and the expected results. See How can I ask better questions on Server Fault? for further guidance." – larsks, Ward
  • "Questions must be relevant to professional system administration. Server Fault is a site dedicated to professionals; novice questions are off-topic. Please see the Help Center for more information on topicality. The best advice we can give you is to hire a professional to help you out." – mfinni, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

Why was this question closed? – Evan Carroll Aug 10 '13 at 18:20
Because you didn't do your homework first. I found the answer at the first search result for windows 8 ipsec. – Michael Hampton Aug 11 '13 at 16:52
@MichaelHampton Seems to me as if Windows 8 doesn't support PSKs, but if you merely don't want to generate certificates, you can use EAP-MScHAPv2. – Evan Carroll Aug 11 '13 at 18:49
@MichaelHampton still like to see this mysterious link that talks about Windows 8 and PSK. – Evan Carroll Aug 12 '13 at 2:50

Neither the IKEv2 VPN client in Windows 7, nor the one in Windows 8 support pre-shared keys for authentication.

The clients support either machine certificates or the Extensible Authentication Protocol (EAP) with methods that use either username/password (EAP-MSCHAPv2), or user certificates (EAP-TLS, no Windows related example on the strongSwan wiki, I'm afraid).

Windows 7 also supports Protected EAP (PEAP), which wraps another EAP method (like EAP-MSCHAPv2) in a TLS tunnel. In addition to that, Windows 8 provides a number of other EAP methods (EAP-TTLS, EAP-AKA, EAP-AKA', EAP-SIM). Both systems also support third-party EAP modules e.g. provided by Cisco (EAP-FAST, EAP-LEAP, EAP-PEAP).

Most of these authentication methods have one thing in common, they require that the server is authenticated with a trusted certificate. That is, you'll have to install the server or CA certificate on the clients. The strongSwan wiki provides a tutorial on setting up a simple PKI (make sure you follow the requirements regarding Windows clients).

share|improve this answer
That's exactly what I was looking for! The client itself doesn't support it for ike2? but it supports it for lt2p/ipsec? That doesn't make much sense to me. – Evan Carroll Jul 26 '13 at 2:26
@EvanCarroll You have to understand that the IKEv1 (L2TP) and IKEv2 clients in Windows are practically two different products that have not much in common. The IKEv2 client was basically developed from scratch for Windows 7. Also, pre-shared keys are not very commonly used for IKEv2 road-warrior scenarios (at least at a corporate level), where they were, or still are, for IKEv1 (XAuth with PSK is still very common in Cisco environments). – ecdsa Jul 26 '13 at 6:55
I didn't understand (prior to you telling me) at all. I was thinking PSK would be /good enough/, or at the very least a stable point in troubleshooting as I got certs up. I'm not very comfortable yet with my understanding of SSL. It has always /just worked/. – Evan Carroll Jul 26 '13 at 7:14

Judging by this listing, it's a regression issue with Strongswan and Windows 8. It does mention a potential workaround but has security risks. I would personally file a bug and see what the developers say.

share|improve this answer
The mentioned problem has nothing to do with pre-shared key authentication, but with Windows 8 using the wrong identity, which was actually fixed by Microsoft in the meantime (the fix is included in KB 2785094 but that is currently not documented). – ecdsa Jul 25 '13 at 22:12
@ecdsa It broke IKEv2, which was what the issue was. Thank you for pointing out the hotfix, though. – Nathan C Jul 25 '13 at 22:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.