How do you create the same IKEv2 VPN Connection that is on a Mac on Ubuntu

user5870571

4/6/24, 11:43 PM

On a Mac, there is an IKEv2 VPN (Settings, Network, Create, VPN, IKEv2). It requires a server address, account name, password, shared secret and group name.

I am trying to sort out what exactly needs done to create that connection in Ubuntu. I have tried Strongswan and L2TP and cannot get the connection to come up.

I have the following packages installed:

strongswan
network-manager-strongswan
libcharon-extra-plugins

I tried following the steps at https://github.com/hwdsl2/setup-ipsec-vpn/blob/master/docs/clients.md#ubuntu-linux with substituting the Phase 1 and Phase 2 settings which I ready directly from the VPN server (aes-sha-modp1024 for both phases), confirmed the lifetimes for the phases are correct, tried with "Enforce UDP encapsulation" enabled and disabled, and tried with "Use IKEv2 key exchange" enabled and disabled.

I reviewed the output from journalctl --no-hostname --unit=NetworkManager | tail -100.

The output included in part, [IKE] received NO_PROPOSAL_CHOSEN error notify. So back to checking the Phase 1 and Phase 2 algorithms. I confirmed they are correct based on the settings in the VPN server and Strongswan's IKEv1 Cipher Suites documentation (https://wiki.strongswan.org/projects/strongswan/wiki/IKEv1CipherSuites). I tried setting the algorithms as aes-sha-modp1024 and aes-sha-modp1024!.

Thank you in advance.

Update 1 - My question is almost identical to this question Where to add the Pre-Shared Key for the Server Authentication with Network Manager for L2TP/IPSEC? but it looks like in that thread, an answer was removed that may have contained useful information.

0 + 2

network-manager

vpn

networking

David

4/7/24, 8:25 AM

An answer that has correct and valuable info is not removed by the Mods. If you think you saw something and now it is not there the person who posted the answer removed it.

Douglas Kosovic

4/26/24, 10:35 PM

Although network-manager-l2tp has a "Use IKEv2 key exchange" checkbox, it is not intended to be used for pure IPsec IKEv2 VPN servers that don't use L2TP. As far as I'm aware, there are no commercial L2TP servers that use IKEv2. `aes-sha-modp1024` is not supported by strongswan IKEv2 as it is considered too weak and deprecated for security reasons, for legacy reasons, strongswan will supports it when using IKEv1

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: How do you create the same IKEv2 VPN Connection that is on a Mac on Ubuntu

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.