Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    IPsec vpn for OCX 10.10.3 and any IOS

    Scheduled Pinned Locked Moved IPsec
    17 Posts 7 Posters 5.2k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • H
      Harlock_99
      last edited by

      Hi,
      question:

      iOS configuration

      Settings -> VPN, VPN configuration of type IPSec.

      Server Address is the public IP of your firewall. Account Name is the pfSense user

      what you mean by pfsense user? The identifier from pre-shared key or the user distinguished name from the Phase 1?

      In Authentication Settings, Shared Secret is the pre-shared
      Group Name is the identifier you created.

      What version of Pfsense you are using (2.2.1)?

      1 Reply Last reply Reply Quote 0
      • V
        viniciusferrao
        last edited by

        Doest not work for me…

        charon: 05[JOB] deleting half open IKE_SA after timeout
        1 Reply Last reply Reply Quote 0
        • H
          Harlock_99
          last edited by

          Updated pfsense to 2.2.2, but still not working with this settings.

          1 Reply Last reply Reply Quote 0
          • R
            richardd
            last edited by

            In System -> User Manager, you need to create a group (let's call it 'My IPsec Group'), and give this group the necessary privilege by adding the group membership called 'User - VPN - IPsec auth Dialin'.

            Then, create a pfSense user account and make it a member of the group you just created.

            See attached pictures for the end result. Works for me with pfSense 2.2.2 + OSX 10.10.3 and IOS 8.3.

            user.png_thumb
            user.png
            group.png_thumb
            group.png

            1 Reply Last reply Reply Quote 0
            • H
              Harlock_99
              last edited by

              Hi

              @richardd:

              In System -> User Manager, you need to create a group (let's call it 'My IPsec Group'), and give this group the necessary privilege by adding the group membership called 'User - VPN - IPsec auth Dialin'.

              Then, create a pfSense user account and make it a member of the group you just created.

              See attached pictures for the end result. Works for me with pfSense 2.2.2 + OSX 10.10.3 and IOS 8.3.

              I have already used these settings (see my previous topic:  https://forum.pfsense.org/index.php?topic=92056.0), it didn't work.

              So my question to okaenrique about the iOS side settings still same:

              iOS configuration

              Settings -> VPN, VPN configuration of type IPSec.

              Server Address is the public IP of your firewall. Account Name is the pfSense user

              what you mean by pfsense user? The identifier from pre-shared key or the user distinguished name from the Phase 1?

              In Authentication Settings, Shared Secret is the pre-shared
              Group Name is the identifier you created.

              1 Reply Last reply Reply Quote 0
              • dennypageD
                dennypage
                last edited by

                They are referring to the Xauth user (as in Mutual PSK + Xauth). In iOS this is "Account" in the IPSec setting. Users are set up in System -> User Manager.

                FWIW, I no longer use "Group Name" in iOS or in OS X. I just leave it blank.

                @Harlock_99:

                what you mean by pfsense user? The identifier from pre-shared key or the user distinguished name from the Phase 1?

                1 Reply Last reply Reply Quote 0
                • R
                  richardd
                  last edited by

                  Okaenrique's instructions are correct, but he left out a small detail about the pfSense group privilege as I described in my previous post. The group I am talking about has nothing to do with the User Distinguished Name or Group Name.

                  If it still doesn't work for you, then post screenshots of your settings and I'll try to help you.

                  1 Reply Last reply Reply Quote 0
                  • dennypageD
                    dennypage
                    last edited by

                    Here are the complete list of my current settings, which are slightly different than above.

                    –-

                    IPsec Phase 1

                    Key Exchange version: Auto
                    Internet Protocol: IPv4
                    Interface: WAN

                    Authentication method: Mutual PSK + Xauth
                    Negotiation mode: main
                    My Identifier: Distinguished name myfirewall.mydomain.org
                    Peer Identifier: mydomain.org
                    Pre-Shared Key: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

                    Encrytption algorithm: AES 256
                    Hash algorithm: SHA1
                    DH key group: 2 (1024 bit)
                    Lifetime: 28800

                    NAT Traversal: Auto
                    Deed Peer Detection: disabled

                    IPsec Phase 2

                    Mode: Tunnel IPv4
                    Local Network: LAN subnet

                    Protocol: ESP
                    Encryption algorithms: AES 256, AES256-GCM/auto
                    Hash algorithms: SHA1, SHA256, SHA384
                    PFS key group: off
                    Lifetime: 3600

                    iOS settings

                    Server: IP address of firewall
                    Account: myiosuser
                    Password: xxxxxxxxxxxxxx
                    Use Certificate: off
                    Group Name: <empty>Secret: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

                    OS X settings

                    Server Address: IP address of firewall
                    Account Name: myosxuser
                    Password: xxxxxxxxxxxxxx
                    Shared Secret: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx
                    Group Name: <empty>---

                    Note that user "myiosuser" and "myosxuser" must exist in System -> User Manager, and they must have the "User - VPN - IPsec auth Dialin" privilege.

                    Hope this helps.</empty></empty>

                    1 Reply Last reply Reply Quote 0
                    • R
                      richardd
                      last edited by

                      See my remarks in red:
                      @dennypage:

                      Here are the complete list of my current settings, which are slightly different than above.

                      –-

                      IPsec Phase 1

                      Key Exchange version: Auto V1
                      Internet Protocol: IPv4
                      Interface: WAN

                      Authentication method: Mutual PSK + Xauth
                      Negotiation mode: main Aggressive
                      My Identifier: Distinguished name myfirewall.mydomain.org
                      Peer Identifier: mydomain.org
                      Pre-Shared Key: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

                      Encrytption algorithm: AES 256
                      Hash algorithm: SHA1
                      DH key group: 2 (1024 bit)
                      Lifetime: 28800

                      NAT Traversal: Auto
                      Deed Peer Detection: disabled

                      –-

                      IPsec Phase 2

                      Mode: Tunnel IPv4
                      Local Network: LAN subnet

                      Protocol: ESP
                      Encryption algorithms: AES 256, AES256-GCM/auto
                      Hash algorithms: SHA1, SHA256, SHA384
                      PFS key group: off
                      Lifetime: 3600

                      iOS settings

                      Server: IP address of firewall
                      Account: myiosuser
                      Password: xxxxxxxxxxxxxx
                      Use Certificate: off
                      Group Name: you can fill in anything, but don't leave empty
                      Secret: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

                      –-

                      OS X settings

                      Server Address: IP address of firewall
                      Account Name: myosxuser
                      Password: xxxxxxxxxxxxxx
                      Shared Secret: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx
                      Group Name: you can fill in anything, but don't leave empty

                      –-

                      Note that user "myiosuser" and "myosxuser" must exist in System -> User Manager, and they must have the "User - VPN - IPsec auth Dialin" privilege.

                      Hope this helps.

                      1 Reply Last reply Reply Quote 0
                      • dennypageD
                        dennypage
                        last edited by

                        Richardd, I wasn't asking a question, I was posting a known working configuration. The configuration I posted works correctly with pfSense 2.2.2, iOS 8.3, and OS X 10.10.3.

                        You need to leave the Group Name empty in order to use Auto Key Exchange. The reason for doing this is to allow mixed use of IKEv1 and IKEv2 by mobile clients.

                        IKEv2 on iOS is supported, but requires a custom profile. On my todo list, but not implemented yet.

                        I have yet to find credible mention of IKEv2 being supported in OS X.  :(

                        1 Reply Last reply Reply Quote 0
                        • H
                          Harlock_99
                          last edited by

                          Hi,
                          thanks for the replies, I will test a similar configuration and will be back to you for the results.

                          1 Reply Last reply Reply Quote 0
                          • R
                            richardd
                            last edited by

                            @dennypage: I stand corrected, I can confirm that your settings are working too on these platforms!

                            Nice work with the auto IKEv1 / IKEv2, thanks!

                            1 Reply Last reply Reply Quote 0
                            • E
                              eri--
                              last edited by

                              https://wiki.strongswan.org/projects/strongswan/wiki/AppleIKEv2Profile

                              Check this one for reference.

                              1 Reply Last reply Reply Quote 0
                              • H
                                Harlock_99
                                last edited by

                                Hi,

                                Sorry for the delay was quite busy at work..  :-\

                                Question in Okaenrique settings:

                                • why mobile client setting as NONE for DATABASE? (by the way change this setting make reboot the PFsense firewall)

                                To test DennyPage settings, I need some more informations:

                                IPsec Phase 1

                                Key Exchange version: Auto
                                Internet Protocol: IPv4
                                Interface: WAN

                                Authentication method: Mutual PSK + Xauth
                                Negotiation mode: main
                                My Identifier: Distinguished name myfirewall.mydomain.org  <–-- it is distinguished name or user distinguisghed name ? I can use fake domain?
                                Peer Identifier: mydomain.org                                              <–-- what is the peer identifer option you choosen distinguished name ?
                                Pre-Shared Key: xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx xxxxxx

                                1 Reply Last reply Reply Quote 0
                                • D
                                  dstroot
                                  last edited by

                                  @dennypage:

                                  Richardd, I wasn't asking a question, I was posting a known working configuration. The configuration I posted works correctly with pfSense 2.2.2, iOS 8.3, and OS X 10.10.3.

                                  You need to leave the Group Name empty in order to use Auto Key Exchange. The reason for doing this is to allow mixed use of IKEv1 and IKEv2 by mobile clients.

                                  IKEv2 on iOS is supported, but requires a custom profile. On my todo list, but not implemented yet.

                                  I have yet to find credible mention of IKEv2 being supported in OS X.  :(

                                  dennypage: I have tried unsuccessfully to replicate your setup.  Any possibility of screen shots?  I just can't seem to get it to work.

                                  1 Reply Last reply Reply Quote 0
                                  • dennypageD
                                    dennypage
                                    last edited by

                                    I have moved from PSK to certificates so I can't easily do screen shots for PSK. However if you post shots of your current config, I will be happy to try and help you. Alternatively, I can provide XML fragments for PSK if you are comfortable with that approach.

                                    I'm currently traveling, so it may be a day or two before I can respond.

                                    @dstroot:

                                    dennypage: I have tried unsuccessfully to replicate your setup.  Any possibility of screen shots?  I just can't seem to get it to work.

                                    1 Reply Last reply Reply Quote 0
                                    • First post
                                      Last post
                                    Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.