I managed to connect two AWS subnets in different zones over strongSwan VPN using
ike2 with the aes256 encryption. So, Master CA key is created, self-signed CA certificate, as well as private and public keys for both gateways. After that, I created certificates for the roadwarrior and export them to win10 client in the
The connection between those two LANs are working, but I am not able to attach the roadwarrior client.
I imported the certificates into win10 and the are normally visible in the certification manager.
Then I created VPN configuration using Windows10 VPN client, and when I run it I got from the Windows message:
A certificate could not be found that can be used with this Extensible Authentication Protocol.
certmagr everything is in the place.
The authentication method used is EAP-tls and it is working without a problem in LAN to LAN model.
Win10 VPN security property setup is:
Type of the VPN: IKE2 , Data Encryption: Require encryption (disconnect if server declines) Authentication: Use Extensible Authentication Protocol -> Microsoft smart card or other certificates (encryption enabled) -> Properties ---> Use certificate on this computer ---> Verify the server's identity by validating the certificate ---> Trusted Root Certificate authority ----> Both certificates CA and the client p12 certificate are visible and checked
Here is ipsec.conf file
config setup charondebug="cfg 2, dmn 2, ike 2,net 2" uniqueids=yes strictcrlpolicy=no conn %default fragmentation=force forceencaps=yes rekeymargin=3m mobike=no keyingtries=%forever ike=aes256-sha256-modp2048,aes256-sha2_256-modp1024! esp=aes256-sh256,aes256-sha2_256! ikelifetime=1h lifetime=8h dpddelay=30 dpdtimeout=120 dpdaction=restart authby=pubkey leftcert=vpn-west-public-certificate.pem leftsendcert=always keyexchange=ikev2 type=tunnel leftca="C=DE, O=Orgname, CN=Orgname Root CA" leftid=13.57.xx.yy left=10.0.0.208 leftsubnet=10.0.0.0/16 conn roadw right=%any rightid=%any rightauth=eap-tls rightsourceip=10.0.0.64/28 rightsendcert=never rightdns=188.8.131.52 eap_identity=%identity auto=add
Here is the IPsec.secrets file
13.57.xx.yy : RSA "/etc/ipsec.d/private/vpn-west-private-key.pem" username : EAP "passphrase"
Any idea where to start, it looks that windows10 is not even starting the session, therefore it looks to me that something is wrong with the configuration of the VPN client at the Win10.