Tools/Strongswan

Strongswan can be considered the most powerful IPsec implementation available in Fedora and EPEL.

Features

IKEv1, IKEv2 (older and current version of Internet Key Exchange)
MOBIKE (mobility and multihoming extension to IKEv2)
IPv4, IPv6 (old and new Internet Protocol)
Road warror setup
NAT traversal
NetworkManager plugin
And much more...

Things Strongswan can do but Openswan cannot

IKEv2 + road warrior
IPv6 + road warrior
Hybrid IPv4/IPv6 tunnels
Multiple IPv4 on a single device

Openswan gives confusing error messages when using IPv6 addresses. You can even have problems if you want to choose a single IPv4 address on an interface where other IPv4 addresses are set up.

Tested with: openswan-2.6.33-1.fc15.x86_64

Source: [1] (in Czech)

Use cases

Simple bi-directional transport channel

conn test
    auto=route
    type=transport
    left=2001:db8::a
    right=2001:db8::b
    authby=psk
    mobike=no

Road warrior (server)

conn test
    auto=add
    type=transport
    left=%any
    right=2001:db8::b
    authby=psk
    mobike=no

Road warrior (client)

conn test
    auto=add
    type=transport
    left=%defaultroute
    leftid=@alpha.example.net
    right=2001:db8::b
    authby=psk
    mobike=no

Tunnel mode

conn test
    auto=route
    type=tunnel
    left=2001:db8::a
    leftsubnet=2001:db8:a:a::/64
    right=2001:db8::b
    leftsubnet=2001:db8:b:b::/64
    authby=psk
    mobike=no

Search