Description

Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts the packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs).

Milesight router supports connecting variety of IPsec clients to router, including ios. In this article, we will use one Milesight router as IPsec server and the topology graph is as below:

Requirement

Any Milesight Router at latest version of firmware

iPhone with ios14

Ubuntu System (Take version 20.04 as example)

Configuration

1. Generate Certificates

Step 1. Install strongSwan and openssl:

sudo apt install strongswan strongswan-pki libstrongswan-extra-plugins openssl -y

Step 2. Run below command:

#Generate CA root private key

ipsec pki --gen --outform pem > ca.key.pem

#Self-sign a CA root certificate based on this private key

ipsec pki --self --in ca.key.pem --dn "C=CN, O=milesight, CN=192.168.22.105" --ca --lifetime 3650 --outform pem > ca.crt

//--self: self-signed certifcate

--lifetime: term of validity, unit is day

--dn: distinguish name

C stands for country name
O stands for organization name
CN stands for common name for user-friendly display, in ios, it must be your router ip or server domain name

#Generate server private key

ipsec pki --gen --outform pem > server.key

#Generate public key from private key

ipsec pki --pub --in server.key --outform pem > server.pub.pem

#Sign a server certificate based on this public key

ipsec pki --issue --lifetime 3600 --cacert ca.crt --cakey ca.key.pem --in server.pub.pem --dn "C=CN, O=milesight, CN=192.168.22.105" --san="192.168.22.105" --flag serverAuth --flag ikeIntermediate --outform pem > server.crt

//--san: serverAltName, in ios, it must be your router ip or server domain name

#Generate client private key

ipsec pki --gen --outform pem > client.key.pem

#Generate public key from private key

ipsec pki --pub --in client.key.pem --outform pem > client.pub.pem

#Sign a client certificate based on this public key

ipsec pki --issue --lifetime 1200 --cacert ca.crt --cakey ca.key.pem --in client.pub.pem --dn "C=CN, O=milesight, CN=192.168.22.105" --outform pem > client.cert.pem

#Packaging certificates to pkcs12

openssl pkcs12 -export -inkey client.key.pem -in client.cert.pem -name "Milesight ios Client Cert" -certfile ca.crt -caname "192.168.22.105" -out client.cert.p12

//Define export password