Lab: Set Up a Site-to-Site IPsec VPN with StrongSwan

#Building the Encrypted Tunnel#link

In this lab, you will implement a Site-to-Site VPN using StrongSwan. You will configure the IKE (Internet Key Exchange) phases to establish a secure tunnel between two networks, simulating a branch office connection to a headquarters.

Phase 1: Installing and Initializing StrongSwan

We begin by installing the StrongSwan suite and preparing the basic configuration for our two gateways (Peer A and Peer B).

Phase 2: Configuring IKEv2 (Phase 1 & Phase 2)

We must define the 'Security Association' (SA). This involves agreeing on the encryption (AES), the hash (SHA256), and the Diffie-Hellman group for the key exchange.

# /etc/ipsec.conf configuration for Peer A
conn site-to-site
  authby=secret
  left=10.0.1.1
  leftsubnet=192.168.1.0/24
  right=10.0.2.1
  rightsubnet=192.168.2.0/24
  ike=aes256-sha256-modp2048!
  esp=aes256-sha256-modp2048!
  type=tunnel
  auto=start

The `ike` line defines Phase 1 (the secure channel), and the `esp` line defines Phase 2 (the actual data encryption). The `!` at the end forces the server to use only these specific algorithms.

Phase 3: Setting the Pre-Shared Key (PSK)

Phase 4: Validating the Tunnel

Once the service is restarted, we check the status to see if the IKE and ESP SAs have been successfully established.

• ▪Ping a device on the remote subnet (192.168.2.10)
• ▪Run tcpdump on the external interface to see ESP packets
• ▪Test the tunnel with different cipher suites to see the effect on latency
• ▪Implement a Dead Peer Detection (DPD) timeout