Reference no: EM133823517
Question: Complete your Assignment by configuring your client to connect to the VPN server and submitting your final report.
Assignment Tasks
After the server is configured correctly, configure your client to connect to the server.
Notes:
1. You can choose either Windows, MacOS, iOS, or Android as the client machine. You do not need to try all of them; you only need to use one of them to connect to the server.
2. The PDF document "Week 11 Assignment Hints" in the Learning Resources contains tips on how to configure your server and use Android to connect to it.
3. Some useful resources to help you install and configure strongSwan are given in the Optional Resources for this week.
4. When testing the connection, it is useful to check the /var/log/syslog for error messages.
The /etc/ipsec.conf file:
[root@etpgl7e etc]# more ipsec.conf
config setup
uniqueids=no
conn %default
reauth=no
ikelifetime=2h
keylife=2h
rekeymargin=10m
keyingtries=1
keyexchange=ikev2
dpdaction=restart
dpddelay=15s
dpdtimeout=5s
conn android
left=%any
leftsubnet=10.20.0.0/16
leftcert=server.cert.pem
leftauth=pubkey
right=%any
rightauth=pubkey
rightsourceip=10.15.0.0/16
eap_identity=%any
auto=add
dpdaction=restart
dpddelay=15s
dpdtimeout=5s
Secret file:
[root@etpgl7e etc]# more ipsec.secrets
# /etc/ipsec.secrets - strongSwan IPsec secrets file:
ECDSA server.key.pem
Generate the self-signed CA keys: openssl req -x509 -days 1460 -newkey rsa:1024 -keyoutca.key.pem -out ca.cert.pem
Copy ca.cert.pem to /etc/ipsec.d/cacerts/ca.cert.pem and keep private key secure.
Generate a private key for strongSwan server: opensslgenrsa -des3 -out server.key.pem 1024
Generate a private key for Android phone (remote client): opensslgenrsa -des3 -out phone.key.pem 1024
To generate certificates, first copy the default openssl configuration file at /usr/lib/ssl/openssl.cnf to the home directory and modify the related paths there. Then create a file "index.txt" and a file "serial" with empty content and run ‘touch index.txt| echo 01> serial'. This step is only necessary for the first time to create a certificate.
Create a certificate request file: openssl req -new -key phone.key.pem -out phone.cert.csr
Run: openssl ca -config openssl.cnf -days 1001 -out phone.cert.pem -infilesphone.cert.csr
Convert/package the pem version to p12 version: openssl pkcs12 -export -out phone.p12 -in phone.cert.pem -certfileca.cert.pem -inkeyphone.key.pem
Copy phone.p12 to the Android phone and it should now connect to the strongSwan server.
Complete the configuration of your client to connect to the VPN server. Submit a 3- to 5-page report in Microsoft Word and APA format that includes the following:
Describe in detail the steps you have taken, with screenshots of major steps. Ensure your report contains the following information:
All steps and commands that you used to install your strongSwan server Get Assistance Now!!
The process (including screenshot) that you used to generate the root keys, etc.
A screenshot to show your strongSwan configuration. This should include the file /etc/ipsec.conf and other configuration files
Description of the steps you took to configure your client machine to connect to the server
(Note: Your Instructor needs sufficient details to see how you made it work.)
Screenshots that show you have connected to the strongSwan
(Note: These screenshots should include the client machine screenshot and the log file at the server to show that your client is connected.)
Note: It is important to submit the screenshot of your client (could be Android phone, iOS, MacOS, Windows or Linux), showing your client is connected to your VPN server.
Your document should be 3-5 pages long (not including the title page or reference list) but the quality of the work is most important, not the number of pages. Cite and reference all sources using APA format and style guidelines.