Configure the responder and the initiator

Configure one CryptoHub-backed responder and one file-key initiator. Replace these placeholders before you run the commands:

<RESPONDER_IP>: IKE address of the CryptoHub-backed gateway
<INITIATOR_IP>: IKE address of the initiating gateway
<RESPONDER_SUBNET>: protected subnet behind the responder
<INITIATOR_SUBNET>: protected subnet behind the initiator

Configure the responder

Run on the responder:

PIN="$(sudo cat /etc/strongswan-chlibs/token-pin)"
KEY_ID="$(sudo cat /etc/strongswan-chlibs/responder-key-id)"

sudo tee /etc/swanctl/swanctl.conf > /dev/null <<EOF
connections {
    responder {
        version = 2
        local_addrs = <RESPONDER_IP>
        remote_addrs = <INITIATOR_IP>
        proposals = aes256-sha256-modp2048

        local {
            auth = pubkey
            id = responder.example.com
            certs = responder-cert.pem
        }
        remote {
            auth = pubkey
            id = initiator.example.com
        }

        children {
            net {
                local_ts = <RESPONDER_SUBNET>
                remote_ts = <INITIATOR_SUBNET>
                esp_proposals = aes256-sha256
                mode = tunnel
                start_action = none
            }
        }
    }
}

secrets {
    token-strongswan {
        module = futurex
        slot = 0
        handle = $KEY_ID
        pin = "$PIN"
    }
}
EOF

unset PIN KEY_ID
sudo chmod 600 /etc/swanctl/swanctl.conf
sudo swanctl --load-all --clear --raw

The output reports successful certificate, token, and connection loads. Run sudo swanctl --list-conns and confirm that it lists responder and the net child.

Configure the initiator

Transfer initiator-key.pem, initiator-cert.pem, and ca-cert.pem to the initiator over an encrypted channel. Run:

sudo install -d -m 755 \
  /etc/swanctl/x509 /etc/swanctl/x509ca /etc/swanctl/private
sudo install -m 644 initiator-cert.pem \
  /etc/swanctl/x509/initiator-cert.pem
sudo install -m 644 ca-cert.pem \
  /etc/swanctl/x509ca/ca-cert.pem
sudo install -m 600 initiator-key.pem \
  /etc/swanctl/private/initiator-key.pem

Write /etc/swanctl/swanctl.conf:

connections {
    initiator {
        version = 2
        local_addrs = <INITIATOR_IP>
        remote_addrs = <RESPONDER_IP>
        proposals = aes256-sha256-modp2048

        local {
            auth = pubkey
            id = initiator.example.com
            certs = initiator-cert.pem
        }
        remote {
            auth = pubkey
            id = responder.example.com
        }

        children {
            net {
                local_ts = <INITIATOR_SUBNET>
                remote_ts = <RESPONDER_SUBNET>
                esp_proposals = aes256-sha256
                mode = tunnel
                start_action = none
            }
        }
    }
}

Run:

sudo chmod 600 /etc/swanctl/swanctl.conf
sudo systemctl restart strongswan-starter
sudo swanctl --load-all --clear --raw

Run sudo swanctl --list-conns. The output must list initiator and the net child.

​Configure the responder

​Configure the initiator

Configure the responder

Configure the initiator