# IPsec with public key authentication on strongSwan < 5.0.0

## Setup

### Generate an RSA keypair

    root@debian:~# mkdir /etc/ipsec.d/public
    root@debian:~# ipsec pki --gen --type rsa --outform pem --size 4096 > /etc/ipsec.d/private/mykey.pem
    root@debian:~# ipsec pki --pub --in /etc/ipsec.d/private/mykey.pem --outform pem > /etc/ipsec.d/public/mykey.pub
    root@debian:~# echo ": RSA mykey.pem" >> /etc/ipsec.secrets

### Exchange public keys with your peer

1. Display the public key. Send the key data to your peer.

    root@debian:~# more /etc/ipsec.d/public/mykey.pub
    -----BEGIN PUBLIC KEY-----
    MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA2/FWIJuVUtfsLovavNp+
    nPSsT2mQoNK3ZUUwuEKfBjT7mhijdXRHh1SAtIaU2aen5+d5q6e27vMCCYOQLagn
    9CkKatBq54zGNvDSzQEpz0mIsaBx9xjvhsgqAmKCTpLtKuMz6cZbH8y8o9/ZZ8Kv
    +Jht67T8BDKXczgOg5IIaX84UpCrlSgmnSvKYKu3PXnt91bZ66HaDZJjPf9aiMNc
    fvuUqVfFWnsV2zI6HFvG/uwkqLalsnPaAwVeIWl2Ovy2Jzdj0GRLSYx87eneSBo+
    7tjlURQTudAj1+53SFOkBcCPSnzPYpIC3hBfZ8Zw8r/25moW3xf8TlLLJqgAh50Y
    tVyvyVSv1MKYBdjZcFsEXUceC5LI9JZryB/Serq0R+4//ZiR3LEtetVKNvco9bcI
    JHXr88HM2XeYRfRPAB6wembIEMKYdwIhwYAPPAtL+lDHtZBiBAIAp0y0FhaozSzl
    MSry8tbJR2fD/i8/yXr5isVfjJZdw8WK0LAd8a8zvmNIFKgiKWjoDgIycM5HrRD+
    rY0Br9xONkNdgB7Lz/wPEyUsiIiZpawM/S4taX7ExK4Wi3pdxkOHLn2ZyaWKsdhX
    PpCkdMfSOJ0SqCUcVze+xD8GlInUQsPgbDGvxT73jT6Ie+wSA94Cgs3mq7FS6cNo
    ZAASv7cT9DG+xfQmjrJC9SUCAwEAAQ==
    -----END PUBLIC KEY-----

1. Convert your peer’s public key to the Base64 RFC 3110 format using the pubkey-converter script, if necessary.

## Configuration

### Configure the phase 1 IKE parameters

In this example, we’ll use the following settings:

Key | Value
--- | ---
Encryption | AES-128
Hash | HMAC-SHA1
DH Group | 5 (modp1536)
Lifetime | 28800 seconds
Peer address | 192.0.2.2
Local address | 192.0.2.1

Note: strongSwan < 5.0.0 will read PEM-formatted private keys, but requires public keys to be added to the configuration in Base64 RFC 3110 format. Convert your host’s public key from PEM to Base64 RFC 3110 for inclusion in ipsec.conf as described below.

1. Configure a connection policy in ipsec.conf for your peer. The `leftrsasigkey` attribute is your host’s public key in Base64 RFC 3110 format enclosed in double quotes, and `rightrsasigkey` is your peer’s key.

    root@debian:~# cat << EOF >> /etc/ipsec.conf
    conn MYPEER
        # peer IPs
        left=192.0.2.1
        right=192.0.2.2
        # phase 1 parameters
        ike=aes128-sha1-modp1536!
        ikelifetime=28800s
        # authentication
        authby=pubkey
        leftrsasigkey=" "
        rightrsasigkey=" "
    EOF

1. All done! Configure the phase 2 parameters as you otherwise would.

## Full GRE/IPsec example

    root@debian:~# ip addr show dev gre1
    11: gre1@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1400 qdisc noqueue state UNKNOWN
        link/gre 192.0.2.1 peer 192.0.2.2
        inet 10.1.2.0/31 scope global gre1
            valid_lft forever preferred_lft forever
        inet6 fe80::200:5efe:6825:1c22/64 scope link
             valid_lft forever preferred_lft forever
    root@debian:~# more /etc/ipsec.conf
    # ipsec.conf - strongSwan IPsec configuration file

    config setup

    conn %default
        keyexchange=ikev1
        dpdaction=restart

    conn MYPEER
        # peer IPs
        left=192.0.2.1
        right=192.0.2.2
        # phase 1 parameters
        ike=aes128-sha1-modp1536!
        ikelifetime=28800s
        # authentication
        authby=pubkey
        leftrsasigkey=" "
        rightrsasigkey=" "
        # phase 2 parameters
        esp=aes128-sha1!
        pfs=yes
        pfsgroup=modp1536
        lifetime=3600s
        type=transport
        leftprotoport=gre
        rightprotoport=gre
        # startup
        auto=route
        keyingtries=%forever