I’m trying to setup a IPSec/IKEv2 VPN Server for roadwarriors on my EdgeRouter 6P which has Linux Strongswan 5.6.3 on board, with Active Directory CA as TRUSTED ROOT CA and Microsoft NPS as Radius for authentication, both installed on Domain Controller with a FQDN.
In the last few days I’ve collected some information about the procedure, I’ll leave the links I found at the end of this post, and I have now some guidelines for the tunnel configuration, but my biggest concern is about certificates; I have to stick to our enterprise CA for a centralized management.
I understood that I need a trusted CA which will sign VPN server and client certificates and its (CA) certificate must be installed on clients keychain. I have AD CA installed on my Domain Controller and I have a few questions:
- I’ve followed a tutorial regarding the creation of IPSEC certificate template under the AD CA, but I’m not completely sure about the parameters, since I could not find a guide involving Microsoft IPSEC certificates for Strongswan.
- I see different file extentions types, like .cert .pem .p12 ecc.. which one should I use?
- AD CA will wait for a certificate request and then deploy? Or I have to create client and server certificates from the AD CA Windows Server interface?
- Some tutorial explain that must be created a certificate for each client, others create just one certificate for the server... so what are all possible ways of authentication?
I’m pretty much confused, as you can see, about certificates deploy and I could not find any explaination about Strongswan related to Microsoft AD CA
It would be great to find someone who can explain the concepts Im lacking about certificate types and different CA, and clarify this procedure part for strongswan.
Thank you in advance!