Skip to main content

Connect strongSwan

This guide explains how to build a Router device to connect VPN S2S with the FPT Smart Cloud VPN Site-to-Site service.

  • Step 1: Configure VPN Site-to-Site
  • Step 2: Configure strongSwan

Ensure the following prerequisites are met:

  • VPNaaS on the Portal
  • Ubuntu 20.04 downloaded and installed with: strongSwan 5.9.14
  • A public IP — for simplicity, assign it directly to the VM rather than using a Floating IP
  • One PfSense VM for debugging (optional)

Step 1: Configure VPN Site-to-Site on FPT Cloud Portal​

Create a Customer Gateway and a VPN Connection for the strongSwan device on the FPT Cloud Portal. For detailed steps, see Create VPN connection.

Step 2: Configure strongSwan VPN​

Run the following commands (replace parameters with your actual values):

Check strongSwan version
swanctl -v

Edit the file /etc/ipsec.conf using the following template:

config setup
        charondebug="all"
        uniqueids=yes

conn myvpn
    type=tunnel
    auto=start
    keyexchange=ikev2
    ike=aes256-sha256-modp2048
    keyingtries=%forever
    lifetime=3600s
    dpddelay=30s
    dpdtimeout=120s
    dpdaction=restart
    esp=aes256-sha256-modp2048
    left=x.x.x.x    //IP of strongSwan
    leftsubnet=x.x.x.x/24 //Subnet of strongSwan
    leftauth=psk
    right=x.x.x.x    // IP of the remote peer
    rightsubnet=x.x.x.x/24 //Subnet of the remote peer
    rightauth=psk
    authby=secret
    auto=start

Edit the file /etc/ipsec.secret using the following template:

x.x.x.x x.x.x.x : PSK "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"   // Pre-shared key

Notes​

  • strongSwan runs as a background service on Ubuntu. Enable multi-network on the CPU for best performance.
  • strongSwan runs as a background service on Ubuntu. Enable the firewall and routing to allow connectivity.
  • If running on FCI's OpenStack, add a Static route on the router with the Destination set to the peer's IP and the nexthop set to the LAN IP of strongSwan.

See also​