IKEv2 roaming VPN in cOS Core without client certificate installation

Question

We want to use a IKEv2 client, for example in MS Windows, to connect to a NetWall firewall, but we do not want to install a certificate on all our clients. Is there a way to do this?

Answer

The answer is yes. Using PSK (pre-shared key) for the IKEv2 tunnel in Windows is not possible as the inbuilt client only supports certificates. However, if we use a certificate in the firewall that is already trusted by the client, there is no need to install a new certificate on the client.

An example would be to use a certificate that is signed by an certificate authority (CA) that is already trusted by the client (e.g. VeriSign, GeoTrust, Go Daddy, LetsEncrypt etc). This is similar to the certificate used by many HTTPS web servers on the Internet. By using such a certificate in the firewall, it will be, by default, trusted by the client and there would be no need to install a client certificate and only a username/password would be needed by the client in order to connect to the firewall.

Please note however that the certificate property used in the firewall still needs to contain the correct DNS entry for the VPN server in order for the client to be able to connect. The DNS entry must also be able to be resolved by the client to the IP of the firewall.

Note: Depending on the CA used, we may need up to 3 certificates in the firewall for this to work (Root, Intermediate (if used) and Gateway certificate).

More information about IKEv2 tunnel setup can be found in the admin guide and/or the following KB articles:

https://kb.clavister.com/324736225/roaming-ikev2-tunnel-setup-in-cos-core-with-xca-ca-and-freeradius 
https://kb.clavister.com/324736172/roaming-windows-ikev2-setup-with-netwall-as-ca-server

The following should also be noted:

• We assume that no existing trusted certificate authority has been changed/removed on the client machine.
• At the time of writing (March 2023), Clavister has tested this with ZeroSSL and LetsEncrypt. However, as long as the client machine has the CA in its trusted list (and the certificate can be used by IPsec) it should function as expected. Note that you must also have the correct DNS entry as described above.
• In a future version of cOS Core (the exact version cannot yet be stated at the time of writing March, 2023) there will be support added to cOS Core to automatically renew certificates using ACME (for example, using Let's Encrypt). This eliminates the need for the administrator to manually renew a public certificate on the firewall (the internal Clavister reference for this feature is COP-20924).

Related articles