IPsec: Setup Ixolate for IKEv1 using XAuth

XAuth was an addition to IKEv1 supporting user authentication credentials additionally to pre-shared keys or certificates. There are three different types supported by Ixolate which we will describe here.

Mutual PSK + XAuth: You define a pre-shared key which is the same for every user and after securing the channel the user authentication via XAuth comes into play. Mutual RSA + XAuth: Instead of using a pre-shared key, every device needs a client certificate to secure the connection plus XAuth for authentication. This is the most secure variant for IKEv1/XAuth but also with the most work to do. Hybrid RSA + XAuth: Hybrid RSA is the same as Mutual, without the need for a client certificate. Only the server will be authenticated (like using HTTPS) to prevent man-in-the-middle attacks like with Mutual PSK. It is more secure than PSK but does not need the complete roll-out process like with Mutual RSA.

We assume you have read the first part at Ipsec-rw

Step 1 - Create Certificates (only for RSA variants)

For Mutual RSA + XAuth and Hybrid RSA + XAuth you need to create a Root CA and a server certificate for your Firewall.

For more information read Setup Self-Signed Certificate Chains

Step 2 - Mobile Clients

First we will need to setup the mobile clients network and authentication source. Go to VPN › IPsec › Mobile Clients

For our example will use the following settings:

IKE Extensions

You can select other options, but we will leave them all unchecked for this example.

Save your settings and select Create Phase1 when it appears. Then enter the Mobile Client Phase 1 setting.

Step 3 - Phase 1 Mobile Clients

Phase 1 General information

Phase 1 proposal (Authentication)

Phase 1 proposal (Algorithms)

Advanced Options are fine by default.

Save your settings.

Step 3 - Phase 2 Mobile Clients

Press the button + in front of the phase 1 entry to add a new phase 2.

General information

Local Network

Phase 2 proposal (SA/Key Exchange)

Save your settings and Enable IPsec, Select:

Step 4 - Add IPsec Users

Go to System › Access › Users and press the + sign in the lower right corner to add a new user.

Enter the following into the form:

Save to apply.

Step 5 - Add client certificate (for Mutual RSA)

This step is only needed for Mutual RSA + XAuth!

Go to System › Trust › Certificates and create a new client certificate. Just click Add, choose your CA and probably increase the lifetime. Everything else besides the CN can be left default. Give a Common Name and Save. Download the newly created certificate as PKCS12 and export it to you enduser device.

Step 6 - Configure Client

To illustrate the client setup we will look at the configuration under macOS, including some screenshots. The configurations for Android and iOS will be settings only.

Configure macOS Client

Start with opening your network settings (System Preferences › Network) and Add a new network by pressing the + in the lower left corner.

Now select VPN and Cisco IPSec, give your connection a name and press Create.

Now enter the details for our connection:

Next press Authentication Settings to add the group name and pre-shared key.

Press OK to save these settings and then Apply to apply them.

Now test the connection by selecting it from the list and hit Connect.

Done

Configure iOS Client

To add a VPN connection on an iOS device go to Settings › General › VPN. Select Add VPN Configuration chose IPsec and use the Following Settings:

Configure Android Client

To add a VPN connection on an Android device go to Settings › Connections › more networks, select VPN. Press the + in the top right corner to add a new VPN connection.

Use the Following Settings:

Save and try connecting. To connect enter Username and Password for the user expert we created in this example.