The
ipsec.secrets
file is usually
found in the
/etc
folder.
Use the strongSwan
client username as the certificate’s common name.
Configure
the following recommended settings in the
ipsec.conf
file:
conn <
connection name
>
keyexchange=
ikev1
authby=
xauthrsasig
ike=
aes-sha1-modp1024
esp=
aes-sha1
xauth=
client
left=<
strongSwan/Linux-client-IP-address
>
leftcert=<
client-certificate-without-password
>
leftsourceip=
%config
right=<
GlobalProtect-gateway-IP-address
>
rightid=%anyCN=<
Subject-name-of-gateway-cert
>”
rightsubnet=
0.0.0.0/0
leftauth2=
xauth
xauth_identity=<
LDAP username
>
auto=
add
Configure the following
recommended settings in the
ipsec.secrets
file:
<
username
> :XAUTH “<
user password
>”
::RSA <
private key file
> “<
passphrase if used
>”