You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how to configure an Ubuntu Linux strongSwan VPN client solution for User VPN Configurations that use certificate authentication.
5
+
author: cherylmc
6
+
ms.service: azure-virtual-wan
7
+
ms.custom: linux-related-content
8
+
ms.topic: how-to
9
+
ms.date: 02/06/2025
10
+
ms.author: cherylmc
11
+
---
12
+
13
+
# Configure strongSwan VPN for User VPN P2S certificate authentication IKEv2 connections - Linux
14
+
15
+
This article helps you connect to your Azure virtual network (VNet) using Virtual WAN User VPN point-to-site (P2S) VPN and **Certificate authentication** from an Ubuntu Linux client using strongSwan.
16
+
17
+
## Before you begin
18
+
19
+
Verify that you are on the correct article. The following table shows the configuration articles available for Azure Virtual WAN P2S VPN clients. Steps differ, depending on the authentication type, tunnel type, and the client OS.
This article assumes that you completed the following prerequisites:
26
+
27
+
* You configured a virtual WAN according to the steps in the [Create a User VPN point-to-site connection](virtual-wan-point-to-site-portal.md) article. Your User VPN configuration must use certificate authentication and the IKEv2 tunnel type.
28
+
* You generated and downloaded the VPN client configuration files. For steps to generate a VPN client profile configuration package, see [Generate VPN client configuration files](virtual-wan-point-to-site-portal.md#download).
29
+
* You have permissions to either generate client certificates, or acquire the appropriate client certificates necessary for authentication.
Copy file name to clipboardExpand all lines: articles/virtual-wan/point-to-site-vpn-client-certificate-openvpn-linux.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -22,11 +22,11 @@ Verify that you are on the correct article. The following table shows the config
22
22
23
23
### Prerequisites
24
24
25
-
This article assumes that you've already performed the following prerequisites:
25
+
This article assumes that you completed the following prerequisites:
26
26
27
-
* You configured a virtual WAN according to the steps in the [Create User VPN point-to-site connections](virtual-wan-point-to-site-portal.md) article. Your User VPN configuration must use certificate authentication and the OpenVPN tunnel type.
27
+
* You configured a virtual WAN according to the steps in the [Create a User VPN point-to-site connection](virtual-wan-point-to-site-portal.md) article. Your User VPN configuration must use certificate authentication and the IKEv2 tunnel type.
28
28
* You generated and downloaded the VPN client configuration files. For steps to generate a VPN client profile configuration package, see [Generate VPN client configuration files](virtual-wan-point-to-site-portal.md#p2sconfig).
29
-
* You can either generate client certificates, or acquire the appropriate client certificates necessary for authentication.
29
+
* You have permissions to either generate client certificates, or acquire the appropriate client certificates necessary for authentication.
Copy file name to clipboardExpand all lines: articles/vpn-gateway/point-to-site-vpn-client-certificate-ike-linux.md
+2-146Lines changed: 2 additions & 146 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ author: cherylmc
6
6
ms.service: azure-vpn-gateway
7
7
ms.custom: linux-related-content
8
8
ms.topic: how-to
9
-
ms.date: 10/15/2024
9
+
ms.date: 02/12/2025
10
10
ms.author: cherylmc
11
11
---
12
12
@@ -27,151 +27,7 @@ This article assumes that you've already performed the following prerequisites:
27
27
* The VPN gateway is configured for point-to-site certificate authentication and the IKEv2 tunnel type. See [Configure server settings for P2S VPN Gateway connections - certificate authentication](point-to-site-certificate-gateway.md) for steps.
28
28
* VPN client profile configuration files have been generated and are available. See [Generate VPN client profile configuration files](point-to-site-certificate-gateway.md#profile-files) for steps.
29
29
30
-
### Connection requirements
31
-
32
-
To connect to Azure using the strongSwan client and certificate authentication via IKEv2 tunnel type, each connecting client requires the following items:
33
-
34
-
* Each client must be configured to use strongSwan.
35
-
* The client must have the correct certificates installed locally.
36
-
37
-
### Workflow
38
-
39
-
The workflow for this article is:
40
-
41
-
1. Install strongSwan.
42
-
1. View the VPN client profile configuration files contained in the VPN client profile configuration package that you generated.
43
-
1. Locate any necessary client certificates.
44
-
1. Configure strongSwan.
45
-
1. Connect to Azure.
46
-
47
-
### About certificates
48
-
49
-
For certificate authentication, a client certificate must be installed on each client computer. The client certificate you want to use must be exported with the private key, and must contain all certificates in the certification path. Additionally, for some configurations, you'll also need to install root certificate information.
50
-
51
-
For more information about certificates for Linux, see the following articles:
When you generate a VPN client profile configuration package, all the necessary configuration settings for VPN clients are contained in a VPN client profile configuration zip file. The VPN client profile configuration files are specific to the P2S VPN gateway configuration for the virtual network. If there are any changes to the P2S VPN configuration after you generate the files, such as changes to the VPN protocol type or authentication type, you need to generate new VPN client profile configuration files and apply the new configuration to all of the VPN clients that you want to connect.
63
-
64
-
Locate and unzip the [VPN client profile configuration package](point-to-site-certificate-gateway.md#profile-files) you generated and downloaded. You can find all of the information that you need for configuration in the **Generic** folder. Azure doesn’t provide a *mobileconfig* file for this configuration.
65
-
66
-
If you don't see the Generic folder, check the following items, then generate the zip file again.
67
-
68
-
* Check the tunnel type for your configuration. It's likely that IKEv2 wasn’t selected as a tunnel type.
69
-
* On the VPN gateway, verify that the SKU isn’t Basic. The VPN Gateway Basic SKU doesn’t support IKEv2. Then, select IKEv2 and generate the zip file again to retrieve the Generic folder.
70
-
71
-
The Generic folder contains the following files:
72
-
73
-
***VpnSettings.xml**, which contains important settings like server address and tunnel type.
74
-
***VpnServerRoot.cer**, which contains the root certificate required to validate the Azure VPN gateway during P2S connection setup.
75
-
76
-
## Configure the VPN client
77
-
78
-
After viewing the VPN client profile files, continue with the steps that you want to use:
79
-
80
-
*[GUI steps](#gui)
81
-
*[CLI steps](#cli)
82
-
83
-
### <aname="gui"></a>GUI steps
84
-
85
-
This section walks you through the configuration using the strongSwan GUI. The following instructions were created on Ubuntu 18.0.4. Ubuntu 16.0.10 doesn’t support strongSwan GUI. If you want to use Ubuntu 16.0.10, you’ll have to use the [command line](#cli). The following examples might not match screens that you see, depending on your version of Linux and strongSwan.
86
-
87
-
1. Open the **Terminal** to install **strongSwan** and its Network Manager by running the command in the example.
88
-
89
-
```
90
-
sudo apt install network-manager-strongswan
91
-
```
92
-
93
-
1. Select **Settings**, then select **Network**. Select the **+** button to create a new connection.
94
-
95
-
:::image type="content" source="./media/point-to-site-vpn-client-cert-linux/edit-connections.png" alt-text="Screenshot shows the network connections page." lightbox="./media/point-to-site-vpn-client-cert-linux/expanded/edit-connections.png":::
96
-
97
-
1. Select **IPsec/IKEv2 (strongSwan)** from the menu, and double-click.
98
-
99
-
:::image type="content" source="./media/point-to-site-vpn-client-cert-linux/add-connection.png" alt-text="Screenshot shows the Add VPN page." lightbox="./media/point-to-site-vpn-client-cert-linux/expanded/add-connection.png":::
100
-
101
-
1. On the **Add VPN** page, add a name for your VPN connection.
102
-
103
-
:::image type="content" source="./media/point-to-site-vpn-client-cert-linux/choose-type.png" alt-text="Screenshot shows Choose a connection type." lightbox="./media/point-to-site-vpn-client-cert-linux/expanded/choose-type.png":::
104
-
105
-
1. Open the **VpnSettings.xml** file from the **Generic** folder contained in the downloaded VPN client profile configuration files. Find the tag called **VpnServer** and copy the name, beginning with 'azuregateway' and ending with '.cloudapp.net'.
1. Paste the name in the **Address** field of your new VPN connection in the **Gateway** section. Next, select the folder icon at the end of the **Certificate** field, browse to the **Generic** folder, and select the **VpnServerRoot** file.
110
-
111
-
1. In the **Client** section of the connection, for **Authentication**, select **Certificate/private key**. For **Certificate** and **Private key**, choose the certificate and the private key that were created earlier. In **Options**, select **Request an inner IP address**. Then, select **Add**.
112
-
113
-
:::image type="content" source="./media/point-to-site-vpn-client-cert-linux/ip-request.png" alt-text="Screenshot shows Request an inner IP address." lightbox="./media/point-to-site-vpn-client-cert-linux/expanded/ip-request.png":::
This section walks you through the configuration using the strongSwan CLI.
122
-
123
-
1. From the VPN client profile configuration files **Generic** folder, copy or move the **VpnServerRoot.cer** to **/etc/ipsec.d/cacerts**.
124
-
125
-
1. Copy or move the files you generated to **/etc/ipsec.d/certs** and **/etc/ipsec.d/private/** respectively. These files are the client certificate and the private key, they need to be located in their corresponding directories. Use the following commands:
0 commit comments