IKEv2 and iOS

Ok since no-one else has replied yet I have had to struggle on myself. I think I have made some progress, it looks like the iOS 9.2.1 IKEv2 client is despite the lack of username/password options still asking for EAP if you create the profile in the GUI. If however you create a mobileconfig with supposedly the same settings then it does not ask for EAP and I have with a mobileconfig file managed to make a successful IKEv2 connection.

(If true this is not the first time I have found a bug in the iOS VPN GUI.)

I ultimately plan anyway to use only mobileconfig files to push these VPN settings out but I still need to tweak things as I believe there is still and issue with the leftid option in StrongSwan5 which is supposed to match the LocalID value.

I feel I have now got it working after finding two issues.

The first issue was as mentioned what I feel to be a bug in iOS 9.2 and still present in 9.2.1 which is that if you configure a VPN profile on the iPhone itself for IKEv2 with certificate authentication then it incorrectly still tells the VPN server it wants to use EAP which is for a username/password authentication.

The second issue is that Apple Configurator when it creates a mobileconfig file for an IKEv2 connection includes the following in the mobileconfig file.

     <key>IPv4</key>

     <dict>

     <key>OverridePrimary</key>

     <integer>1</integer>

     </dict>

Note: The older iPhone Configuration Utility cannot create IKEv2 settings but when used to create Cisco IPSec settings it also includes the above but set to 0 i.e. 'false'.

If OverridePrimary is set to 1 i.e. 'true' then this tells the iPhone to route all traffic via the VPN connection. There is nothing inherently wrong with this and in fact this is exactly what I want to happen. The issue seems to be that this conflicts with the standard setting of StrongSwan5 which I already have set at its end to force all VPN users to send all traffic via the VPN connection. This is done by including the following in /etc/ipsec.conf on the StrongSwan5 server.

leftsubnet=0.0.0.0/0

With the above setting as added by Apple Configurator as mentioned this seems to conflict with the StrongSwan5 setting and results in a failed connection. If however I change it by manually editing the mobileconfig file to be 0 i.e. 'false' then this removes the conflict and the iPhone successfully connects. StrongSwan5 still forces all the traffic to be sent via the VPN.

Unfortunately there is no option in Apple Configurator itself to change this setting. So for me the method is -

• Use Apple Configurator to create an IKEv2 profile
• Add the client certificate and private key as a .p12
• Add separately the self-signed rootCA (cannot be in the client .p12)
• Save the resulting mobileconfig
• Manually edit the mobileconfig with a text editor and change the setting for OverridePrimary
• Send the mobileconfig file to the iPhone

I have only ever used RSA certificates.

doug_b_nyc wrote:

I am trying to configure an "always on" VPN between my iOS device and a FortiGate firewall, which requires an IKEv2 VPN. Although I'm very familiar with IPSec VPNs using IKEv1, the IKEv2 configuration on iOS is new to me. Any guidance on the use of the Remote ID and Local ID fields in IKEv2 would be greatly appreciated.

I have been using StrongSwan5 rather than Fortinet but here is what I found with that.

RemoteID is the name being used to identify the IKEv2 server, this can be the fully qualified DNS name of the VPN server but in theory could be some other identifier and would default to the 'Distinguished Name' of the SSL certificate. In the case of StrongSwan5 you also define this in the /etc/ipsec.conf configuration file using the line leftid=identifier so maybe this is also defined somewhere in the Fortninet settings. I did use the FQDN name i.e. leftid=host.domain.com.

LocalID is the identifier used by the client device e.g. an iPhone. I used the name defined in the security certificate being used by the client device. Now I seem to recall that for IKEv2 Apple do not support using a FQDN for client devices which is what I had been using as the Distinguished Name for my certificates so I have been defining as a subject alternative name an additional name in the format of a (fake) email address e.g. serialnumber@domain.com and I use that as the LocalID. I do not have to define this specifically on the StrongSwan5 server as I currently use in /etc/ipsec.conf the line rightid="*" with the asterisk meaning accept anything, I believe rightid=%any means the same thing. However something along the lines rightid=@domain.com might be better, I think the exact format to do this in StrongSwan is 'complex' and might be rightid=@*@domain.com which is why I started off with it completely open.

Note: If you do not define a LocalId on the iOS device it sends its IP address which would still be matched by my current rightid="*" but other than for site-to-site links with static IP addresses using an IP address would prevent you restricting values as a security measure due to iOS devices typically having dynamic i.e. random IP addresses.