Corporate VPN on StrongSwan IKEv2: Remote Access Without Clients

We have often encountered situations where corporate users couldn't connect to VPN due to missing client software on their laptops. Once we had to set up remote access for a company with 300 employees, where every third user worked on macOS. IKEv2 solves this problem: native clients on Windows, macOS, iOS, and Android support it out of the box — no additional software needed. We configure StrongSwan, a mature IKEv2 implementation for Linux, with full EAP authentication support and integration with corporate LDAP. Below we'll cover configuration, typical issues, and the implementation process, which takes from one day.

Why IKEv2 StrongSwan wins over OpenVPN and WireGuard?

For corporate remote access with hundreds of users, StrongSwan is more convenient: no client installation required, and authentication can be centralized via RADIUS and LDAP. This reduces load on the help desk — users connect themselves without administrator involvement.

Step-by-step StrongSwan setup: 4 steps

Step 1. Installation and certificate creation

Install StrongSwan and PKI utilities, then create a private CA and server certificate. The CN of the server certificate must match the server's public FQDN or IP.

apt install strongswan strongswan-pki libcharon-extra-plugins
# CA
pki --gen --type rsa --size 4096 --outform pem > /etc/ipsec.d/private/ca.key
pki --self --ca --lifetime 3650 --in /etc/ipsec.d/private/ca.key \
    --dn "CN=VPN CA, O=Example Corp" \
    --outform pem > /etc/ipsec.d/cacerts/ca.crt
# Server certificate (with serverAuth and iKEIntermediate flags)
pki --gen --type rsa --size 2048 --outform pem > /etc/ipsec.d/private/server.key
pki --pub --in /etc/ipsec.d/private/server.key | \
    pki --issue --lifetime 730 \
    --cacert /etc/ipsec.d/cacerts/ca.crt \
    --cakey /etc/ipsec.d/private/ca.key \
    --dn "CN=vpn.example.com" \
    --san vpn.example.com \
    --flag serverAuth \
    --flag ikeIntermediate \
    --outform pem > /etc/ipsec.d/certs/server.crt

Step 2. Configuration via swanctl

Since StrongSwan 5.7+, use swanctl.conf. Example with EAP-MSCHAPv2 and an address pool for 250 clients:

# /etc/swanctl/swanctl.conf
authorities {
  vpn-ca {
    cacert = ca.crt
  }
}
connections {
  ikev2-eap {
    version = 2
    proposals = aes256gcm16-sha256-ecp256,aes256-sha256-modp2048
    local_addrs = %any
    remote_addrs = %any
    local {
      auth = pubkey;
      certs = server.crt;
      id = vpn.example.com
    }
    remote {
      auth = eap-mschapv2;
      eap_id = %any
    }
    children {
      ikev2-eap {
        local_ts = 0.0.0.0/0
        remote_ts = dynamic
        dpd_action = clear
        esp_proposals = aes256gcm16-sha256,aes256-sha256
      }
    }
    pools = vpn-pool
    dpd_delay = 30s
    send_cert = always
  }
}
pools {
  vpn-pool {
    addrs = 10.20.0.0/24;
    dns = 10.0.0.1, 8.8.8.8
  }
}
secrets {
  eap-user1 {
    id = user1;
    secret = "UserPassword123"
  }
  eap-user2 {
    id = user2;
    secret = "AnotherPassword"
  }
}

Load configuration without restart: swanctl --load-all.

Step 3. Firewall and IP forwarding

iptables -A INPUT -p udp --dport 500 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
iptables -A INPUT -p esp -j ACCEPT
iptables -A FORWARD -s 10.20.0.0/24 -j ACCEPT
iptables -A FORWARD -d 10.20.0.0/24 -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.20.0.0/24 -o ens3 -j MASQUERADE
sysctl -w net.ipv4.ip_forward=1

Don't forget to save rules: iptables-save > /etc/iptables/rules.v4. StrongSwan handles NAT-T correctly, which is important for clients behind NAT.

Step 4. Authentication via LDAP/RADIUS

For large infrastructures (500+ users), connect FreeRADIUS with an LDAP backend:

# /etc/strongswan.d/charon/eap-radius.conf
eap-radius {
  servers {
    primary {
      address = 10.0.0.5;
      secret = radius_shared_secret
    }
  }
}

In the connection, change remote { auth = eap-radius }. All users authenticate through a central directory — AD or OpenLDAP.

How to integrate StrongSwan with Active Directory?

Integration with Active Directory is done via a RADIUS proxy, as shown in step 4. FreeRADIUS queries LDAP (AD) and returns the result to StrongSwan. Additionally, you can configure automatic certificate issuance via Microsoft NDES or your own CA with group policies. This allows users to connect without entering a password — only by certificate issued by the corporate CA.

How to configure native clients?

Windows 10/11: Settings → VPN → Add VPN connection → IKEv2. Sign-in type: user name and password. Before that, import ca.crt into the 'Trusted Root Certification Authorities' store (certmgr.msc).

macOS/iOS: Settings → VPN → IKEv2. Install the CA certificate via a profile (Apple Configurator or manually).

Android: Native IKEv2 (Android 11+) or the StrongSwan app.

What typical errors occur during IKEv2 setup?

The most common is Windows not connecting. Detailed negotiation logs help quickly find the cause:

swanctl --log journalctl -u strongswan -f 

Almost always the reason: the server certificate lacks iKEIntermediate in Extended Key Usage, or the root CA is not trusted on the client. Check the chain and re-import ca.crt. The second most common is a mismatch between the server identifier (CN or SAN) and the address entered by the client. The third is blocking of UDP ports 500 and 4500 by the firewall. Diagnosis time is no more than 30 minutes.

What's included?

• Configured StrongSwan server with certificates and user pool
• Firewall rules and automation scripts
• Instructions for connecting native clients (Windows, macOS, iOS, Android)
• Integration with LDAP/RADIUS (optional)
• Testing and documentation handover

Monitoring active connections

To monitor the number of concurrent sessions, you can use Prometheus metrics via StrongSwan IPsec pki. The exporter collects data on tunnel states and CPU load. We guarantee that after setup, you'll have a transparent view of connections.

Timelines and cost

Cost is calculated individually after infrastructure audit. Order VPN setup — get a ready solution in 1-2 days. Get a consultation from an engineer on StrongSwan setup. Contact us: we'll evaluate your project in one day. Implementation pays off by reducing support costs for client applications and simplifying new employee onboarding.