As far as I understand, FreeBSD comes with the native ability to make vpn connections.
Ist strongswan a package, that comes on top of the freebsd ipsec stack or is it a replacement?
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
FreeBSD's network stack supports IPsec, but that's just the lower layer of IPsec-based VPN connections.
If you don't want to configure security associations (SAs) manually (with encryption/authentication keys you need to place securely on both ends and have to replace regularly) you'll want to use a keying daemon that implements the Internet Key Exchange (IKE) protocol to automate this. strongSwan implements both versions of that protocol and allows setting up and replacing SAs automatically, the hosts are thereby authenticated securely (e.g. using X.509 certificates) and keys are dynamically generated using e.g. the Diffie-Hellman key exchange.
strongSwan operates as a userland daemon that communicates with the FreeBSD kernel using the PF_KEYv2 protocol in order to configure the negotiated IPsec SAs and policies (which define which traffic is secured by which SA) in the network stack.
racoon is an alternative keying daemon, but it only implements the IKEv1 protocol and it's not actively developed anymore (unless you consider its forks in e.g. iOS/OS X and Android). The ipsec-tools package that provides racoon also comes with setkey, which may be used for manual keying but also allows querying the kernel state. So this utility might be useful even when using other keying daemons like strongSwan to check if the installed SAs and policies are as they should be.