# IPsec with public key authentication on VyOS/EdgeOS

## Setup

### Generate an RSA keypair

    ubnt@ubnt:~$ generate vpn rsa-key bits 4096 random /dev/urandom
    Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key

    Your new local RSA key has been generated
    The public portion of the key is:

     ==

### Exchange public keys with your peer

1. Display the public key. Send the key data portion to your peer.

    ubnt@ubnt:~$ show vpn ike rsa-keys

    Local public key (/config/ipsec.d/rsa-keys/localhost.key):

     ==

1. Convert your peer’s public key to the Base64 RFC 3110 format using the pubkey-converter script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

In this example, we’ll use the following settings:

Key | Value
--- | ---
Encryption | AES-128
Hash | HMAC-SHA1
DH Group | 5 (modp1536)
Lifetime | 28800 seconds
Peer address | 192.0.2.2
Local address | 192.0.2.1

1. Add your peer’s public key

    vyos@vyos:~$ configure
    [edit]
    vyos@vyos# set vpn rsa-keys rsa-key-name my-peer rsa-key

1. Configure an ISAKMP policy

    [edit]
    vyos@vyos# edit vpn ipsec ike-group FOO
    [edit vpn ipsec ike-group FOO]
    vyos@vyos# set lifetime 28800
    [edit vpn ipsec ike-group FOO]
    vyos@vyos# set proposal 1 encryption aes128
    [edit vpn ipsec ike-group FOO]
    vyos@vyos# set proposal 1 hash sha1
    [edit vpn ipsec ike-group FOO]
    vyos@vyos# set proposal 1 dh-group 5
    [edit vpn ipsec ike-group FOO]
    vyos@vyos# commit

1. Set your peer definition to use the public key

    [edit vpn ipsec ike-group FOO]
    vyos@vyos# up
    [edit vpn ipsec]
    vyos@vyos# edit site-to-site peer 192.0.2.2
    [edit vpn ipsec site-to-site peer 192.0.2.2]
    vyos@vyos# set authentication mode rsa
    [edit vpn ipsec site-to-site peer 192.0.2.2]
    vyos@vyos# set authentication rsa-key-name my-peer

1. All done! Configure the phase 2 parameters as you otherwise would.

## Full GRE/IPsec example

    interfaces {
        ethernet eth0 {
            address 192.0.2.1/30
            description WAN
            duplex auto
            speed auto
        }
        tunnel tun0 {
            address 10.1.2.0/31
            encapsulation gre
            local-ip 192.0.2.1
            mtu 1400
            multicast disable
            remote-ip 192.0.2.2
            ttl 255
        }
    }
    vpn {
        ipsec {
            esp-group BAR {
                compression disable
                lifetime 3600
                mode transport
                pfs dh-group5
                proposal 1 {
                    encryption aes128
                    hash sha1
                }
            }
            ike-group FOO {
                lifetime 28800
                proposal 1 {
                    dh-group 5
                    encryption aes128
                    hash sha1
                }
            }
            ipsec-interfaces {
                interface eth0
            }
            site-to-site {
                peer 192.0.2.2 {
                    authentication {
                        mode rsa
                        rsa-key-name my-peer
                    }
                    connection-type initiate
                    default-esp-group BAR
                    ike-group FOO
                    local-ip 192.0.2.1
                    tunnel 0 {
                        protocol gre
                    }
                }
            }
        }
        rsa-keys {
            rsa-key-name my-peer {
                rsa-key 0sAwEAAbsbRoUcgdm4A4Nm+PLxWcW+zFis7pkaJ0MkGVzM7VC8nmngkM+W2zqZyQ4NUTBKKfGOUc4Ogi6gyhlzUnHdag9tDERIX+BwlDO6G4arod9z9KqmJuX4AOYVjH5QlAPz7NDMAezVekGoVLPGdOAMPD6NN54ihLRH6V3if8AGoJRpiajhcgQipjeQnhH4QhsYK4XSjayGT1onQwA8nhy5kt4ofyqSale4Fl4166S9tCn4RKwtlJDjR6VIrg6op6Ip8+ke2vjEHPJHj6qVsxfRgOk2d8pY8oPVt8ayc5F1z+lqJ7R0fADfN+AQSaBqOMmg5dHDFYWwgYkU5egdVKS7Oko6uNuUWsZ0VEnRoPZ4syJEUbiF5wGfaVBaaVLZYUlRLQCffB4JKzp+JesVToCX6JYRfb4JYQWFCDeQfrqRZHM4r13h8MOWPn9cqXcP47RKJjzNp6595biUotmCbMHyy/uveMWxK6vDzPQRkywqMMJE2qOyACmbMnSce9KlYhvma82Vd+z/9/U9NEy0s5MaYNDn+q+KYT5My3NSv52F6sLVGrKxTk79tzUejZcoukJv+gf51Epam4kVHzPIal/khsfjZn6YCU2j5+qcdRmzF+SG5c2WicvEU2Gc4ratfYNEPxU5oArzHIhIz6x2nAF+szcx/x8GEyXPNHnxEboJB7ox
            }
        }
    }