swanctl: setting up a connection with EAP-MSCHAPv2 authentication

This article walks through preparing a swanctl configuration file for strongSwan.
It assumes that the CA, server and client certificates have already been created; they were covered in detail in the previous article, so we won't revisit them here.

---

Where the strongSwan and swanctl configurations live

Modern versions of strongSwan use two different configuration approaches:

strongSwan (the charon daemon)

The main configuration file: /etc/strongswan.conf

Used for:

• global daemon parameters
• enabling and configuring plugins
• logging

swanctl (the modern management interface)

The main configuration file: /etc/swanctl/swanctl.conf

Additional directories:

/etc/swanctl/x509ca/    # CA certificates
/etc/swanctl/x509/      # server/client certificates
/etc/swanctl/private/   # private keys
/etc/swanctl/crls/      # CRLs (if revocation checking is used)

Used for:

• describing VPN connections
• address pools
• credentials (EAP)
• policies and CHILD_SA

⚠️ ipsec.conf and ipsec.secrets are not used with this approach.

---

Example configuration: IKEv2 + EAP-MSCHAPv2

Below is an example swanctl.conf that:

• creates an IKEv2 connection
• authenticates the user with EAP-MSCHAPv2
• authenticates the server with a certificate (server-cert.pem)
• hands out addresses to clients from a pool
• works with Windows, macOS, iOS and Android

Example /etc/swanctl/swanctl.conf

connections {
  ikev2-eap {
    version = 2
    rekey_time = 0
    mobike = yes
    send_cert = ifasked
    unique = never
    proposals = aes256-sha256-modp2048,aes256-sha1-modp2048,aes256-sha256-modp1024,aes256-sha1-modp1024

    local {
      auth = pubkey
      certs = server-cert.pem
      id = vpn.example.com
    }

    remote {
      auth = eap-mschapv2
      eap_id = %any
    }

    children {
      ikev2-eap {
        local_ts  = 0.0.0.0/0, ::/0
        esp_proposals = aes256-sha256,aes256-sha1
        rekey_time = 0
        dpd_action = trap
      }
    }

    pools = ipv4-pool, ipv6-pool
  }
}

pools {
  ipv4-pool {
    addrs = 172.42.2.0/24
    dns = 8.8.8.8,8.8.4.4
  }
  ipv6-pool {
    addrs = fe80::/112
  }
}

secrets {
  eap-user {
    id = user1
    secret = StrongPa$sw0rd
  }
}

What the main configuration sections are for

connections

Describes IKE connections:

• IKEv2 parameters
• authentication methods
• certificates
• cipher suites
• child SAs (CHILD_SA)

Each block inside connections is a logical VPN connection.

---

local

Describes the server side:

• auth = pubkey — authentication with a certificate
• certs — the server certificate
• id — the server's IKE identity (usually an FQDN)

---

remote

Describes the client side:

• auth = eap-mschapv2 — user authentication
• eap_id = %any — allows any username

---

children

Describes the CHILD_SAs (the tunnels that carry traffic):

• local_ts / remote_ts — which networks are routed
• esp_proposals — ESP algorithms

---

pools

Used to hand out IP addresses to clients:

• IPv4 / IPv6 ranges
• DNS servers
• other network parameters

---

secrets

Stores EAP credentials:

• the login (id)
• the password (secret)

Used only for password sign-in, not for certificates.

Summary

The swanctl.conf configuration lets you describe a VPN connection completely without the deprecated ipsec.conf.