@lifespeed said in Safe IKEv2 Configuration for pfSense and Windows 10 and macOS:
tup, but maybe that isn't needed?
VPN/IPsecPre-Shared/Keys:
I don't think it's necessary as long at the trusted key is installed. I automated that in an earlier script (which I'm still adapting, but the cert portion is relevant). I have another version which maps out multiple subnets, I just don't have access to it from here.
$Name = "NAME"
$Server = "HOST"
$DnsSuffix = "DnsSuffix"
$RemoteNetwork = "xxxxxxxx/24"
$Cert = @'
-----BEGIN CERTIFICATE-----
CUT AND PASTED KEY HERE
-----END CERTIFICATE-----
'@
## Add the cert
$EncodedCert = [system.Text.Encoding]::UTF8.GetBytes($Cert)
$pfx = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2
$store = new-object System.Security.Cryptography.X509Certificates.X509Store(“Root”,”LocalMachine”)
## Download the cert file
$pfx.Import($EncodedCert);
$store.Open("MaxAllowed")
$store.Add($pfx)
$store.Close()
## Add the connection
try
{
Add-VpnConnection -Name $Name -ServerAddress $Server -TunnelType "Ikev2" -EncryptionLevel "Required" -AuthenticationMethod Eap -SplitTunneling -AllUserConnection -RememberCredential -PassThru -DnsSuffix $DnsSuffix
}
catch [Microsoft.Management.Infrastructure.CimException]
{
## Ignore
}
Add-VpnConnectionRoute -ConnectionName $Name -DestinationPrefix $RemoteNetwork
