InfoScale™ 9.0 Cluster Server Administrator's Guide - Linux

To install strongSwan

1. Install strongSwan and the related RPMs.

   # zypper install strongswan*

2. Verify that strongSwan is installed.

   # rpm -qa | grep strongswan

To create a secure host-to-host VPN configuration

1. Create the /etc/ipsec.conf file.

   Sample entries in the configuration file:

   # ipsec.conf - strongSwan IPsec configuration file
   # basic configuration
   config setup
       charon.start_all=true
   conn %default    <-------- This need not be changed as this is default.
       keyexchange=ikev2
       ikelifetime=60m
       keylife=20m
       rekeymargin=3m
       keyingtries=1
       authby=secret
   conn myvpn    <-------- Connection 1 created for link1
       left=10.10.10.1    <-------- Local node IP address of first private LLT link
       leftsubnet=10.10.255.255    <-------- Subnet of first Private LLT link of local node
       right=10.10.10.2    <-------- Remote  node IP address of first private LLT link
       rightsubnet=10.10.255.255    <-------- Subnet of first Private LLT link of remote node
       auto=start
   conn myvpn1    <-------- Connection 1 created for link2
       left=20.20.20.1    <-------- Local node IP address of second private LLT link
       leftsubnet=20.20.255.255    <-------- Subnet of second Private LLT link of local node
       right=20.20.20.2
       rightsubnet=20.20.255.255
       auto=start

2. Create the /etc/ipsec.secrets file, which contains information about the private keys and the mechanism used for the IPSec configuration.

   Sample entries in the secrets file:

   # ipsec.secrets
   # This file holds the RSA private keys or the PSK preshared secrets for the IKE/IPsec authentication. See the ipsec.secrets(5) manual page.
   10.10.10.1 10.10.10.2 : PSK "vcs1234"
   ---------- 10.10.10.1 is local/left node IP and 10.10.10.2 is remote/right node IP.
   ---------- Pre-shared key (PSK) is a mechanism similar to RSA, EAP.

To enable strongSwan and start the service

1. To view the IPsec VPN configuration.

   # systemctl enable strongswan-starter.service

2. Restart the service.

   # systemctl restart strongswan-starter.service

   This service internally starts the IPsec service as well.

To verify the host-to-host VPN

1. Enable the strongSwan service.

   # ipsec status
   
   Security Associations (1 up, 0 connecting):
       myvpn[2]: ESTABLISHED 17 minutes ago, 10.10.10.1[10.10.10.1]...10.10.10.2[10.10.10.2]
       myvpn{3}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: cf633b82_i cba64c78_o
       myvpn{3}:   10.10.255.255/32 === 10.10.255.255/32

2. To view further details about the IPsec configuration.

   # ipsec statusall
   Status of IKE charon daemon (strongSwan 5.9.11, Linux 5.14.21-150500.53-default, x86_64):
     uptime: 17 minutes, since May 22 14:11:46 2025
     malloc: sbrk 3170304, mmap 0, used 1174208, free 1996096
     worker threads: 10 of 16 idle, 6/0/0/0 working, job queue: 0/0/0/0, scheduled: 4
     loaded plugins: charon ldap pkcs11 mgf1 nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs12 pgp dnskey sshkey pem openssl pkcs8 af-alg fips-prf gmp curve25519 agent hmac kdf gcm drbg curl soup attr kernel-netlink resolve socket-default farp stroke vici smp updown eap-identity eap-sim eap-sim-pcsc eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth eap-md5 eap-gtc eap-mschapv2 eap-dynamic eap-radius eap-tls eap-ttls eap-peap eap-tnc xauth-generic xauth-eap xauth-pam tnc-imc tnc-imv tnc-tnccs tnccs-20 tnccs-11 tnccs-dynamic dhcp certexpire led duplicheck radattr addrblock unity counters
   Listening IP addresses:
     30.30.30.30
     10.10.10.1
     20.20.20.1
   Connections:
       myvpn:  10.10.10.1...10.10.10.2  IKEv2
       myvpn:   local:  [10.10.10.1] uses pre-shared key authentication
       myvpn:   remote: [10.10.10.2] uses pre-shared key authentication
       myvpn:   child:  10.10.255.255/32 === 10.10.255.255/32 TUNNEL
   Security Associations (1 up, 0 connecting):
       myvpn[2]: ESTABLISHED 16 minutes ago, 10.10.10.1[10.10.10.1]...10.10.10.2[10.10.10.2]
       myvpn[2]: IKEv2 SPIs: b28588f4fd24c13b_i 1287cf3c3b31e804_r*, pre-shared key reauthentication in 38 minutes
       myvpn[2]: IKE proposal: AES_CBC_128/HMAC_SHA2_256_128/PRF_HMAC_SHA2_256/ECP_256
       myvpn{3}:  INSTALLED, TUNNEL, reqid 1, ESP SPIs: cf633b82_i cba64c78_o
       myvpn{3}:  AES_CBC_128/HMAC_SHA2_256_128, 0 bytes_i, 0 bytes_o, rekeying in 14 minutes
       myvpn{3}:   10.10.255.255/32 === 10.10.255.255/32