StrongSwan: Connecting to FortiGate IKEv2 IPSec VPN using PSK + EAP
Hello traveler, I'm assuming you've stumbled upon this post after using very specific search terms and are perhaps now at the end of your rope. I hope I can maybe be your last stop.
There's a lot that's going to depend on your own setup, such as which cipher suites you're using, your local and remote subnets, etc. I'm not posting this as a definitive guide to get your swanctl.conf perfect - I'm assuming you've already got it to a place where it "should be working".
My goal is instead to draw attention to the changes that took my tunnel creation getting totally dropped and ignored by the FortiGate after first contact, to it actually trying to authenticate. It was of course, very simple, but took me hours upon hours to finally get right.
The lynchpin was this: Set Remote auth to PSK. Set Local auth to EAP. Make sure Local is set to round 2, otherwise it sends your EAP credentials before it's asked and the Fortigate shrugs it off.
Note that on my FortiGate side, I'm not requesting a specific peer ID, which is why I have Local "id" set to blank below. If you, for instance, have FortiGate set to accept specific peer IDs (Configured in the Authentication section of the IPSec Tunnel configuration, under Peer Types) you can enter your peer ID here. I've confirmed this works.
Lastly, when connecting, make sure you're using the command:
sudo swanctl --initiate --child hq
If you initiate without specifying the child, it gets stuck at the end and will never fully complete.
Here's my exact StrongSwan config with all the identities changed -
swanctl.conf:
connections { hq { remote_addrs = hq.example.com version = 2 vips = 0.0.0.0 proposals = aes128-aes256-sha256-modp2048-none rekey_time = 86400 mobike = no remote { id = %any auth = psk } local { round = 2 auth = eap id = eap_id = remoteusername } children { hq { remote_ts = 0.0.0.0/0 local_ts = 0.0.0.0/0 esp_proposals = aes128-aes256-sha256-modp2048-none rekey_time = 43200 } } } } secrets { ike-psk { secret = 24Q8E61G632D2B1B } eap-remoteuser { id = remoteusername secret = P4ssw0rd } }