Moving strongSwan from ipsec.conf to swanctl

What is strongSwan

strongSwan is a popular open-source VPN implementation based on the IPsec / IKEv1 / IKEv2 protocols, widely used for site-to-site and remote-access VPNs.

The project is actively developed, supports modern cryptographic algorithms, EAP authentication, certificates, MOBIKE and IKEv2, and works well for both server and client scenarios.

---

Two ways to configure strongSwan

Historically, strongSwan has had two approaches to installation and configuration.

1. Classic (legacy, ipsec.conf)

• Configured through:
  • ipsec.conf
  • ipsec.secrets
• Managed with the ipsec command
• Uses the starter daemon
• This approach is considered deprecated, but is still supported for backward compatibility

2. Modern (swanctl)

• Configured through swanctl.conf
• Connections are managed with the swanctl utility
• Talks directly to the charon daemon
• The option recommended by the strongSwan developers

---

Benefits of using swanctl

Moving to swanctl brings a number of significant benefits:

• Modern architecture
  swanctl talks directly to charon, without the intermediate starter layer.

• Dynamic configuration loading
  Connections, certificates, keys and CRLs can be loaded and updated without restarting the service.

• A clear configuration hierarchy
  swanctl.conf has a logical structure:

  • connections
  • secrets
  • authorities
  • pools

• The future of strongSwan
  New features and improvements appear in swanctl first, not in the legacy ipsec.conf configuration.

---

Installing strongSwan with swanctl on Ubuntu 24.04

On Ubuntu 24.04 all the required packages are available in the official repositories.

Minimal installation

sudo apt update
sudo apt install -y strongswan-swanctl strongswan-pki charon-systemd

Useful additional packages

sudo apt install -y libstrongswan-standard-plugins libstrongswan-extra-plugins

Checking the service

After installation, the main service - charon-systemd - is started automatically by systemd:

systemctl status strongswan

The management utility:

swanctl --version

---

An important note

When you use swanctl, the files:

• ipsec.conf
• ipsec.secrets

are not used and can be empty or missing altogether.

Moreover, swanctl and ipsec cannot work together. You have to pick one, and it had better be swanctl.

What's next?

1. Recall how to set up the legacy option.
2. The /etc/swanctl layout and setting up a CA, certificates and CRLs in strongSwan
3. Setting up a connection with EAP-MSCHAPV2 authentication
4. Setting up a connection with EAP-TLS authentication
5. Setting up a connection with both EAP-TLS and EAP-MSCHAPV2 authentication.