- IPsec: Setup OPNsense for IKEv2 EAP-RADIUS
- Step 1 - Create Certificates
- Step 2 - Setup Radius
- Step 3 - Mobile Clients
- Step 4 - Phase 1 Mobile Clients
- Step 5 - Phase 2 Mobile Clients
- Step 6 - Add IPsec Users
EAP-RADIUS via IKEv2 is nearly the same as EAP-MSCHAPv2, but authentication is done against a Radius instance. We assume you have read the first part at IPsec: Setup Remote Access
For EAP-RADIUS with IKEv2 you need to create a Root CA and a server certificate for your Firewall.
Go toand click Add. Give it a Descriptive Name and as Method choose Create internal Certificate Authority. Increase the Lifetime and fill in the fields matching your local values. Now go to and create a new certificate for the Firewall itself. Important is to change the Type to server. The Common Name can be the hostname of the Firewall and set as Alternative Name the FQDN your Firewall how it is known to the WAN side. This is most important as your VPN will drop when the FQDN does not match the ones of the certificate.
If you already have a CA roll out a server certificate and import the CA itself viaand the certificate with the key in .
If you already have a local Radius server, add a new client with the IP address of your Firewall, set a shared secret, go to OPNsense UI toand add a new instance:
|Descriptive Name||Name||Give it a name|
|Type||Radius||This is what we want|
|Hostname or IP Address||Radius IP||Set the IP of your Radius server|
|Shared Secret||s3cureP4ssW0rd||Choose a secure password|
When you do not have an own Radius instance just use the OPNsense plugin and follow this guide: FreeRADIUS
First we will need to setup the mobile clients network and authentication source. Go to
For our example will use the following settings:
|Enable||checked||check to enable mobile clients|
|User Authentication||Nothing||As we use Radius, no need to select anything|
|Group Authentication||none||Leave on none|
|Virtual Address Pool||10.10.0.0/24||Enter the IP range for the remote clients|
You can select other options, but we will leave them all unchecked for this example.
Save your settings and select Create Phase1 when it appears. Then enter the Mobile Client Phase 1 setting.
|Connection method||default||default is ‘Start on traffic’|
|Key Exchange version||V2||only V2 is supported for EAP-RADIUS|
|Interface||WAN||choose the interface connected to the internet|
|Description||MobileIPsec||freely chosen description|
|Authentication method||EAP-RADIUS||This is the method we want here|
|My identifier||Distinguished Name||Set the FQDN you used within certificate|
|My Certificate||Certificate||Choose the certificate from dropdown list|
|Encryption algorithm||AES||For our example we will use AES/256 bits|
|Hash algoritm||SHA1, SHA256||SHA1 and SHA256 for compatibility|
|DH key group||1024, 2048 bit||1024 and 2048 bit for compatibility|
|Lifetime||28800 sec||lifetime before renegotiation|
Advanced Options are fine by default.
Save your settings.
Press the button that says ‘+ Show 0 Phase-2 entries’
You will see an empty list:
Now press the + at the right of this list to add a Phase 2 entry.
|Mode||Tunnel IPv4||Select Tunnel mode|
|Description||MobileIPsecP2||Freely chosen description|
|Protocol||ESP||Choose ESP for encryption|
|Encryption algorithms||AES / 256||For this example we use AES 256|
|Hash algorithms||SHA1, SHA256||Same as before, mix SHA1 and SHA256|
|PFS Key group||off||Most mobile systems do not support PFS in Phase2|
Save your settings and Enable IPsec, Select:
If you already had IPsec enabled and added Road Warrior setup, it is important to restart the whole service via services widget in the upper right corner of IPSec pages or viasince applying configuration only reloads it, but a restart also loads the required modules of strongSwan.