Chapter 6. Setting up an IPsec VPN

Procedure

1. If Libreswan is not yet installed:

   1. Install the libreswan package:

      # dnf install libreswan

      Copy to Clipboard Toggle word wrap

   2. Initialize the Network Security Services (NSS) database:

      # ipsec initnss

      Copy to Clipboard Toggle word wrap

      The command creates the database in the /var/lib/ipsec/nss/ directory.

   3. Enable and start the ipsec service:

      # systemctl enable --now ipsec

      Copy to Clipboard Toggle word wrap

   4. Open the IPsec ports and protocols in the firewall:

      # firewall-cmd --permanent --add-service="ipsec"
      # firewall-cmd --reload

      Copy to Clipboard Toggle word wrap

2. Import the PKCS #12 file into the NSS database:

   # ipsec import ~/file.p12
   Enter password for PKCS12 file: <password>
   pk12util: PKCS12 IMPORT SUCCESSFUL
   correcting trust bits for Example-CA

   Copy to Clipboard Toggle word wrap

3. Display the nicknames of the server and CA certificates:

   # certutil -L -d /var/lib/ipsec/nss/
   Certificate Nickname     Trust Attributes
                            SSL,S/MIME,JAR/XPI
   
   vpn-gateway              u,u,u
   Example-CA               CT,,
   ...

   Copy to Clipboard Toggle word wrap

   You need this information for the configuration file.

4. Create a .conf file for the connection in the /etc/ipsec.d/ directory. For example, create the /etc/ipsec.d/host-to-site.conf file with the following settings:

   1. Add a config setup section to enable CRL checks:

      config setup
          crl-strict=yes
          crlcheckinterval=1h

      Copy to Clipboard Toggle word wrap

      The settings specified in the example include the following:

      crl-strict=yes

      Enables CRL checks. Authenticating clients are rejected if no CRL is available in the NSS database.

      crlcheckinterval=1h

      Re-fetches the CRL from the URL specified in the server’s certificate after the specified period.

   2. Add a section for the gateway:

      conn <connection_name>
          # General setup and authentication type
          auto=start
          ikev2=insist
          authby=rsasig
      
          # VPN gateway settings
          left=%defaultroute
          leftid=%fromcert
          leftcert="<server_certificate_nickname>"
          leftrsasigkey=%cert
          leftsendcert=always
          leftsubnet=192.0.2.0/24
          rekey=no
          mobike=yes
          narrowing=yes
      
          # Client-related settings
          right=%any
          rightid=%fromcert
          rightrsasigkey=%cert
          rightaddresspool=198.51.100.129-198.51.100.254
          rightmodecfgclient=yes
          modecfgclient=yes
          modecfgdns=192.0.2.5
          modecfgdomains="example.com"
      
          # Dead Peer Detection
          dpddelay=30
          dpdtimeout=120
          dpdaction=clear

      Copy to Clipboard Toggle word wrap

      The settings specified in the example include the following:

      ikev2=insist

      Defines the modern IKEv2 protocol as the only allowed protocol without fallback to IKEv1.

      left=%defaultroute

      Dynamically sets the IP address of the default route interface when the ipsec service starts. Alternatively, you can set the left parameter to the IP address or the FQDN of the host.

      leftid=%fromcert and rightid=%fromcert

      Configures Libreswan to retrieve the identity from the distinguished name (DN) field of the certificate.

      leftcert="<server_certificate_nickname>"

      Sets the nickname of the server’s certificate used in the NSS database.

      leftrsasigkey=%cert and rightrsasigkey=%cert

      Configures Libreswan to use the RSA public key embedded in the certificate.

      leftsendcert=always

      Instructs the gateway to always send the certificate, so that clients can validate it against the CA certificate.

      leftsubnet=<subnets>

      Specifies the subnets connected to the gateway that clients can access through the tunnel.

      mobike=yes

      Enables clients to seamlessly roam among networks.

      rightaddresspool=<ip_range>

      Specifies from which range the gateway can assign IP addresses to the clients.

      modecfgclient=yes

      Enables clients to receive the DNS server IP set in the modecfgdns parameter and the DNS search domain set in modecfgdomains.

   For details about all parameters used in the example, see the ipsec.conf(5) man page on your system.

5. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

6. Restart the ipsec service:

   # systemctl restart ipsec

   Copy to Clipboard Toggle word wrap

   If you use auto=start in the configuration file, the connection is automatically activated. With other methods, additional steps are required to activate the connection. For details, see the ipsec.conf(5) man page on your system.

Verification

1. Configure a client and connect to the VPN gateway.

2. Check if the service loaded the CRL and added the entries to the NSS database:

   # ipsec listcrls
   
   List of CRLs:
   
   issuer: CN=Example-CA
   revoked certs: 1
   updates: this Tue Jul 15 10:22:36 2025
            next Sun Jan 11 10:22:36 2026
   
   List of CRL fetch requests:
   
   Jul 15 15:13:56 2025, trials: 1
          issuer:  'CN=Example-CA'
          distPts: 'https://ca.example.com/crl.pem'

   Copy to Clipboard Toggle word wrap

Procedure

1. Initialize the Network Security Services (NSS) database:

   # ipsec initnss

   Copy to Clipboard Toggle word wrap

   The command creates the database in the /var/lib/ipsec/nss/ directory.

2. Import the PKCS #12 file into the NSS database:

   # ipsec import ~/file.p12
   Enter password for PKCS12 file: <password>
   pk12util: PKCS12 IMPORT SUCCESSFUL
   correcting trust bits for Example-CA

   Copy to Clipboard Toggle word wrap

3. Display the nicknames of the user and CA certificates:

   # certutil -L -d /var/lib/ipsec/nss/
   Certificate Nickname     Trust Attributes
                            SSL,S/MIME,JAR/XPI
   
   user                     u,u,u
   Example-CA               CT,,
   ...

   Copy to Clipboard Toggle word wrap

   You require this information in the configuration file.

4. Press the Super key, type Settings, and press Enter to open the GNOME Settings application.
5. Click the + button next to the VPN entry.
6. Select IPsec based VPN from the list.

7. On the Identity tab, fill the fields as follows:

   Expand

   Table 6.1. Identity tab settings

   Field name	Value	Corresponding ipsec.conf parameter
   Name	<networkmanager_profile_name>	N/A
   Gateway	<ip_address_or_fqdn_of_the_gateway>	right
   Type	IKEv2 (certificate)	authby
   Group name	%fromcert	leftid
   Certificate name	<user_certificate_nickname>	leftcert
   Remote ID	%fromcert	rightid

   Show more
8. Click Advanced.

9. In the Advanced properties window, fill the fields of the Connectivity tab as follows:

   Expand

   Table 6.2. Connectivity tab settings

   Field name	Value	Corresponding ipsec.conf parameter
   Remote Network	192.0.2.0/24	rightsubnet
   Narrowing	Selected	narrowing
   Enable MOBIKE	yes	mobike
   Delay	30	dpddelay
   Timeout	120	dpdtimeout
   Action	Clear	dpdaction

   Show more
10. Click Apply to return to the connection settings.
11. Click Apply to save the connection.
12. In the Network tab of the Settings application, toggle the switch next to the VPN profile to activate the connection.

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - hosts:
                 managed-node-01.example.com:
                 managed-node-02.example.com:
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the peers between which you want to configure a VPN. If an entry is not an Ansible managed node, you must specify its fully-qualified domain name (FQDN) or IP address in the hostname parameter, for example:

             ...
             - hosts:
                 ...
                 external-host.example.com:
                   hostname: 192.0.2.1

   Copy to Clipboard Toggle word wrap

   The role configures the VPN connection on each managed node. The connections are named <peer_A>-to-<peer_B>, for example, managed-node-01.example.com-to-managed-node-02.example.com. Note that the role cannot configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these peers.

   auth_method: psk

   Enables PSK authentication between the peers. The role uses openssl on the control node to create the PSK.

   auto: <startup_method>

   Specifies the startup method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - name: control_plane_vpn
               hosts:
                 managed-node-01.example.com:
                   hostname: 203.0.113.1  # IP address for the control plane
                 managed-node-02.example.com:
                   hostname: 198.51.100.2 # IP address for the control plane
               auth_method: psk
               auto: start
             - name: data_plane_vpn
               hosts:
                 managed-node-01.example.com:
                   hostname: 10.0.0.1   # IP address for the data plane
                 managed-node-02.example.com:
                   hostname: 172.16.0.2 # IP address for the data plane
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the hosts between which you want to configure a VPN. The connections are named <name>-<IP_address_A>-to-<IP_address_B>, for example control_plane_vpn-203.0.113.1-to-198.51.100.2.

   The role configures the VPN connection on each managed node. Note that the role cannot configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these hosts.

   auth_method: psk

   Enables PSK authentication between the hosts. The role uses openssl on the control node to create the pre-shared key.

   auto: <startup_method>

   Specifies the startup method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Create a playbook file, for example, ~/playbook.yml, with the following content:

   ---
   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com
     tasks:
       - name: IPsec VPN with PSK authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - hosts:
                 managed-node-01.example.com:
                   subnets:
                     - 192.0.2.0/24
                 managed-node-02.example.com:
                   subnets:
                     - 198.51.100.0/24
                     - 203.0.113.0/24
               auth_method: psk
               auto: start
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   hosts: <list>

   Defines a YAML dictionary with the gateways between which you want to configure a VPN. If an entry is not an Ansible-managed node, you must specify its fully-qualified domain name (FQDN) or IP address in the hostname parameter, for example:

             ...
             - hosts:
                 ...
                 external-host.example.com:
                   hostname: 192.0.2.1

   Copy to Clipboard Toggle word wrap

   The role configures the VPN connection on each managed node. The connections are named <gateway_A>-to-<gateway_B>, for example, managed-node-01.example.com-to-managed-node-02.example.com. Note that the role cannot configure Libreswan on external (unmanaged) nodes. You must manually create the configuration on these peers.

   subnets: <yaml_list_of_subnets>

   Defines subnets in classless inter-domain routing (CIDR) format that are connected through the tunnel.

   auth_method: psk

   Enables PSK authentication between the peers. The role uses openssl on the control node to create the PSK.

   auto: <startup_method>

   Specifies the startup method of the connection. Valid values are add, ondemand, start, and ignore. For details, see the ipsec.conf(5) man page on a system with Libreswan installed. The default value of this variable is null, which means no automatic startup operation.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

2. Validate the playbook syntax:

   $ ansible-playbook --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

3. Run the playbook:

   $ ansible-playbook ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. Edit the ~/inventory file, and append the cert_name variable:

   managed-node-01.example.com cert_name=managed-node-01.example.com
   managed-node-02.example.com cert_name=managed-node-02.example.com
   managed-node-03.example.com cert_name=managed-node-03.example.com

   Copy to Clipboard Toggle word wrap

   Set the cert_name variable to the value of the common name (CN) field used in the certificate for each host. Typically, the CN field is set to the fully-qualified domain name (FQDN).

2. Store your sensitive variables in an encrypted file:

   1. Create the vault:

      $ ansible-vault create ~/vault.yml
      New Vault password: <vault_password>
      Confirm New Vault password: <vault_password>

      Copy to Clipboard Toggle word wrap

   2. After the ansible-vault create command opens an editor, enter the sensitive data in the <key>: <value> format:

      pkcs12_pwd: <password>

      Copy to Clipboard Toggle word wrap
   3. Save the changes, and close the editor. Ansible encrypts the data in the vault.

3. Create a playbook file, for example, ~/playbook.yml, with the following content:

   - name: Configuring VPN
     hosts: managed-node-01.example.com, managed-node-02.example.com, managed-node-03.example.com
     vars_files:
       - ~/vault.yml
     tasks:
       - name: Install LibreSwan
         ansible.builtin.package:
           name: libreswan
           state: present
   
       - name: Identify the path to IPsec NSS database
         ansible.builtin.set_fact:
           nss_db_dir: "{{ '/etc/ipsec.d/' if
             ansible_distribution in ['CentOS', 'RedHat']
             and ansible_distribution_major_version is version('8', '=')
             else '/var/lib/ipsec/nss/' }}"
   
       - name: Locate IPsec NSS database files
         ansible.builtin.find:
           paths: "{{ nss_db_dir }}"
           patterns: "*.db"
         register: db_files
   
       - name: Initialize IPsec NSS database if not initialized
         ansible.builtin.command:
           cmd: ipsec initnss
         when: db_files.matched == 0
   
       - name: Copy PKCS #12 file to the managed node
         ansible.builtin.copy:
           src: "~/{{ inventory_hostname }}.p12"
           dest: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           mode: 0600
   
       - name: Import PKCS #12 file in IPsec NSS database
         ansible.builtin.shell:
           cmd: 'pk12util -d {{ nss_db_dir }} -i /etc/ipsec.d/{{ inventory_hostname }}.p12 -W "{{ pkcs12_pwd }}"'
   
       - name: Remove PKCS #12 file
         ansible.builtin.file:
           path: "/etc/ipsec.d/{{ inventory_hostname }}.p12"
           state: absent
   
       - name: Opportunistic mesh IPsec VPN with certificate-based authentication
         ansible.builtin.include_role:
           name: redhat.rhel_system_roles.vpn
         vars:
           vpn_connections:
             - opportunistic: true
               auth_method: cert
               policies:
                 - policy: private
                   cidr: default
                 - policy: private
                   cidr: 192.0.2.0/24
                 - policy: clear
                   cidr: 192.0.2.1/32
           vpn_manage_firewall: true
           vpn_manage_selinux: true

   Copy to Clipboard Toggle word wrap

   The settings specified in the example playbook include the following:

   opportunistic: true

   Enables an opportunistic mesh among multiple hosts. The policies variable defines for which subnets and hosts traffic must or can be encrypted and which of them should continue using plain text connections.

   auth_method: cert

   Enables certificate-based authentication. This requires that you specify the nickname of each managed node’s certificate in the inventory.

   policies: <list_of_policies>

   Defines the Libreswan policies in YAML list format.

   The default policy is private-or-clear. To change it to private, the above playbook contains an according policy for the default cidr entry.

   To prevent a loss of the SSH connection during the execution of the playbook if the Ansible control node is in the same IP subnet as the managed nodes, add a clear policy for the control node’s IP address. For example, if the mesh should be configured for the 192.0.2.0/24 subnet and the control node uses the IP address 192.0.2.1, you require a clear policy for 192.0.2.1/32 as shown in the playbook.

   For details about policies, see the ipsec.conf(5) man page on a system with Libreswan installed.

   vpn_manage_firewall: true

   Defines that the role opens the required ports in the firewalld service on the managed nodes.

   vpn_manage_selinux: true

   Defines that the role sets the required SELinux port type on the IPsec ports.

   For details about all variables used in the playbook, see the /usr/share/ansible/roles/rhel-system-roles.vpn/README.md file on the control node.

4. Validate the playbook syntax:

   $ ansible-playbook --ask-vault-pass --syntax-check ~/playbook.yml

   Copy to Clipboard Toggle word wrap

   Note that this command only validates the syntax and does not protect against a wrong but valid configuration.

5. Run the playbook:

   $ ansible-playbook --ask-vault-pass ~/playbook.yml

   Copy to Clipboard Toggle word wrap

Verification

1. On a node in the mesh, ping another node to activate the connection:

   [root@managed-node-01]# ping managed-node-02.example.com

   Copy to Clipboard Toggle word wrap

2. Confirm that the connection is active:

   [root@managed-node-01]# ipsec trafficstatus
   006 #2: "private#192.0.2.0/24"[1] ...192.0.2.2, type=ESP, add_time=1741938929, inBytes=372408, outBytes=545728, maxBytes=2^63B, id='CN=managed-node-02.example.com'

   Copy to Clipboard Toggle word wrap

Procedure

1. If Libreswan is not yet installed, perform the following steps:

   1. Install the required packages:

      # dnf install nmstate libreswan NetworkManager-libreswan

      Copy to Clipboard Toggle word wrap

   2. Restart the NetworkManager service:

      # systemctl restart NetworkManager

      Copy to Clipboard Toggle word wrap

   3. Initialize the Network Security Services (NSS) database:

      # ipsec initnss

      Copy to Clipboard Toggle word wrap

      The command creates the database in the /var/lib/ipsec/nss/ directory.

   4. Open the IPsec ports and protocols in the firewall:

      # firewall-cmd --permanent --add-service="ipsec"
      # firewall-cmd --reload

      Copy to Clipboard Toggle word wrap

2. Create an RSA key pair:

   # ipsec newhostkey

   Copy to Clipboard Toggle word wrap

   The ipsec utility stores the key pair in the NSS database.

3. Display the Certificate Key Attribute ID (CKAID) on both the left and right peers:

   # ipsec showhostkey --list
   < 1> RSA keyid: <key_id> ckaid: <ckaid>

   Copy to Clipboard Toggle word wrap

   You require the CKAIDs of both peers in the next steps.

4. Display the public keys:

   1. On the left peer, enter:

      # ipsec showhostkey --left --ckaid <ckaid_of_left_peer>
              # rsakey AwEAAdKCx
              leftrsasigkey=0sAwEAAdKCxpc9db48cehzQiQD...

      Copy to Clipboard Toggle word wrap

   2. On the right peer, enter:

      # ipsec showhostkey --right --ckaid <ckaid_of_right_peer>
              # rsakey AwEAAcNWC
              rightrsasigkey=0sAwEAAcNWCzZO+PR1j8WbO8X...

      Copy to Clipboard Toggle word wrap

   The commands display the public keys with the corresponding parameters that you must use in the configuration file.

5. Create a YAML file, for example ~/ipsec-host-to-host-rsa-auth.yml, with the following content:

   ---
   interfaces:
   - name: '<connection_name>'
     type: ipsec
     libreswan:
       ikev2: insist
   
       left: <ip_address_or_fqdn_of_left_peer>
       leftid: peer_b
       leftrsasigkey: <public_key_of_left_peer>
       leftmodecfgclient: false
   
       right: <ip_address_or_fqdn_of_right_peer>
       rightid: peer_a
       rightrsasigkey: <public_key_of_right_peer>
       rightsubnet: <ip_address_of_right_peer>/32

   Copy to Clipboard Toggle word wrap

   The settings specified in the example include the following:

   ikev2: insist

   Defines the modern IKEv2 protocol as the only allowed protocol without fallback to IKEv1. This setting is mandatory in a host-to-host configuration with Nmstate.

   left=<ip_address_or_fqdn_of_left_peer> and right=<ip_address_or_fqdn_of_right_peer>

   Defines the IP address or DNS name of the peers.

   leftid=<id> and rightid=<id>

   Defines how each peer is identified during the Internet Key Exchange (IKE) negotiation process. This can be an IP address or a literal string. Note that NetworkManager interprets all values other than IP addresses as a literal string and internally adds a leading @ sign. This requires that the Libreswan peer also uses literal strings as IDs or authentication fails.

   leftrsasigkey=<public_key> and rightrsasigkey=<public_key>

   Specifies the public key of the peers. Use the values displayed by the ipsec showhostkey command in a previous step.

   leftmodecfgclient: false

   Disables dynamic configuration on this host. This setting is mandatory in a host-to-host configuration with Nmstate.

   rightsubnet: <ip_address_of_right_peer>/32

   Defines that the host can only access this peer. This setting is mandatory in a host-to-host configuration with Nmstate.

6. Apply the settings to the system:

   # nmstatectl apply ~/ipsec-host-to-host-rsa-auth.yml

   Copy to Clipboard Toggle word wrap

Procedure

1. If Libreswan is not yet installed, perform the following steps:

   1. Install the required packages:

      # dnf install nmstate libreswan NetworkManager-libreswan

      Copy to Clipboard Toggle word wrap

   2. Restart the NetworkManager service:

      # systemctl restart NetworkManager

      Copy to Clipboard Toggle word wrap

   3. Initialize the Network Security Services (NSS) database:

      # ipsec initnss

      Copy to Clipboard Toggle word wrap

      The command creates the database in the /var/lib/ipsec/nss/ directory.

   4. Open the IPsec ports and protocols in the firewall:

      # firewall-cmd --permanent --add-service="ipsec"
      # firewall-cmd --reload

      Copy to Clipboard Toggle word wrap

2. Create an RSA key pair:

   # ipsec newhostkey

   Copy to Clipboard Toggle word wrap

   The ipsec utility stores the key pair in the NSS database.

3. Display the Certificate Key Attribute ID (CKAID) on both the left and right peer:

   # ipsec showhostkey --list
   < 1> RSA keyid: <key_id> ckaid: <ckaid>

   Copy to Clipboard Toggle word wrap

   You require the CKAIDs of both peers in the following steps.

4. Display the public keys:

   1. On the left peer, enter:

      # ipsec showhostkey --left --ckaid <ckaid_of_left_peer>
              # rsakey AwEAAdKCx
              leftrsasigkey=0sAwEAAdKCxpc9db48cehzQiQD...

      Copy to Clipboard Toggle word wrap

   2. On the right peer, enter:

      # ipsec showhostkey --right --ckaid <ckaid_of_right_peer>
              # rsakey AwEAAcNWC
              rightrsasigkey=0sAwEAAcNWCzZO+PR1j8WbO8X...

      Copy to Clipboard Toggle word wrap

   The commands display the public keys with the corresponding parameters that you must use in the configuration file.

5. Create a YAML file, for example ~/ipsec-site-to-site-rsa-auth.yml, with the following content:

   ---
   interfaces:
   - name: '<connection_name>'
     type: ipsec
     libreswan:
       ikev2: insist
   
       left: <ip_address_or_fqdn_of_left_peer>
       leftid: peer_b
       leftrsasigkey: <public_key_of_left_peer>
       leftmodecfgclient: false
       leftsubnet: 198.51.100.0/24
   
       right: <ip_address_or_fqdn_of_right_peer>
       rightid: peer_a
       rightrsasigkey: <public_key_of_right_peer>
       rightsubnet: 192.0.2.0/24

   Copy to Clipboard Toggle word wrap

   The settings specified in the example include the following:

   ikev2: insist

   Defines the modern IKEv2 protocol as the only allowed protocol without fallback to IKEv1. This setting is mandatory in a site-to-site configuration with Nmstate.

   left=<ip_address_or_fqdn_of_left_peer> and right=<ip_address_or_fqdn_of_right_peer>

   Defines the IP address or DNS name of the peers.

   leftid=<id> and rightid=<id>

   Defines how each peer is identified during the Internet Key Exchange (IKE) negotiation process. This can be an IP address or a literal string. Note that NetworkManager interprets all values other than IP addresses as a literal string and internally adds a leading @ sign. This requires that the Libreswan peer also uses literal strings as IDs or authentication fails.

   leftrsasigkey=<public_key> and rightrsasigkey=<public_key>

   Specifies the public key of the peers. Use the values displayed by the ipsec showhostkey command in a previous step.

   leftmodecfgclient: false

   Disables dynamic configuration on this host. This setting is mandatory in a site-to-site configuration with Nmstate.

   leftsubnet=<subnet> and rightsubnet=<subnet>

   Defines subnets in classless inter-domain routing (CIDR) format that are connected through the tunnel.

6. Enable packet forwarding:

   # echo "net.ipv4.ip_forward=1" > /etc/sysctl.d/95-IPv4-forwarding.conf
   # sysctl -p /etc/sysctl.d/95-IPv4-forwarding.conf

   Copy to Clipboard Toggle word wrap

7. Apply the settings to the system:

   # nmstatectl apply ~/ipsec-site-to-site-rsa-auth.yml

   Copy to Clipboard Toggle word wrap

Verification

1. Display the IPsec status:

   # ipsec status

   Copy to Clipboard Toggle word wrap

   If the connection is successfully established, the output contains lines as follows:

   • Phase 1 of an Internet Key Exchange version 2 (IKEv2) negotiation has been successfully completed:

     000 #1: "<connection_name>":500 STATE_V2_ESTABLISHED_IKE_SA (established IKE SA); REKEY in 27935s; REPLACE in 28610s; newest; idle;

     Copy to Clipboard Toggle word wrap

     The Security Association (SA) is now ready to negotiate the actual data encryption tunnels, known as child SAs or Phase 2 SAs.

   • A child SA has been established:

     000 #2: "<connection_name>":500 STATE_V2_ESTABLISHED_CHILD_SA (established Child SA); REKEY in 27671s; REPLACE in 28610s; IKE SA #1; idle;

     Copy to Clipboard Toggle word wrap

     This is the actual tunnel that your data traffic flows through.

2. From a client in the local subnet, ping a client in the remote subnet.

Procedure

1. If Libreswan is not yet installed:

   1. Install the required packages:

      # dnf install nmstate libreswan NetworkManager-libreswan

      Copy to Clipboard Toggle word wrap

   2. Restart the NetworkManager service:

      # systemctl restart NetworkManager

      Copy to Clipboard Toggle word wrap

   3. Initialize the Network Security Services (NSS) database:

      # ipsec initnss

      Copy to Clipboard Toggle word wrap

      The command creates the database in the /var/lib/ipsec/nss/ directory.

   4. Open the IPsec ports and protocols in the firewall:

      # firewall-cmd --permanent --add-service="ipsec"
      # firewall-cmd --reload

      Copy to Clipboard Toggle word wrap

2. Import the PKCS #12 file into the NSS database:

   # ipsec import ~/file.p12
   Enter password for PKCS12 file: <password>
   pk12util: PKCS12 IMPORT SUCCESSFUL
   correcting trust bits for Example-CA

   Copy to Clipboard Toggle word wrap

3. Display the nicknames of the user and CA certificates:

   # certutil -L -d /var/lib/ipsec/nss/
   Certificate Nickname     Trust Attributes
                            SSL,S/MIME,JAR/XPI
   
   user                     u,u,u
   Example-CA               CT,,
   ...

   Copy to Clipboard Toggle word wrap

   You require this information in the Nmstate YAML file.

4. Create a YAML file, for example, ~/ipsec-host-to-site-cert-auth.yml, with the following content:

   ---
   interfaces:
   - name: '<connection_name>'
     type: ipsec
     libreswan:
       ikev2: insist
   
       left: <ip_address_or_fqdn_of_left_peer>
       leftid: '%fromcert'
       leftcert: <user_certificate_nickname>
   
       right: <ip_address_or_fqdn_of_right_peer>
       rightid: '%fromcert'
       rightsubnet: 192.0.2.0/24

   Copy to Clipboard Toggle word wrap

   The settings specified in the example include the following:

   ikev2: insist

   Defines the modern IKEv2 protocol as the only allowed protocol without fallback to IKEv1. This setting is mandatory in a host-to-site configuration with Nmstate.

   left=<ip_address_or_fqdn_of_left_peer> and right=<ip_address_or_fqdn_of_right_peer>

   Defines the IP address or DNS name of the peers.

   leftid=%fromcert and rightid=%fromcert

   Configures Libreswan to retrieve the identity from the distinguished name (DN) field of the certificate.

   leftcert="<server_certificate_nickname>"

   Sets the nickname of the server’s certificate used in the NSS database.

   rightsubnet: <subnet>

   Defines the subnet in classless inter-domain routing (CIDR) format that is connected to the gateway.

5. Apply the settings to the system:

   # nmstatectl apply ~/ipsec-host-to-site-cert-auth.yml

   Copy to Clipboard Toggle word wrap