Features
Below you'll find some of the key features of strongSwan. More information and how-tos can be found in the documentation.
Internet Key Exchange (IKE)
- Implements the IKEv2 (RFC 7296) key exchange protocol (IKEv1 is also supported)
- Fully tested support of IPv6 IPsec tunnel and transport mode connections
- Dynamic IP address and interface update with MOBIKE (RFC 4555)
- Automatic insertion and deletion of IPsec-policy-based firewall rules
- NAT-Traversal via UDP encapsulation and port floating (RFC 3947)
- Support of IKEv2 message fragmentation (RFC 7383) to avoid issues with IP fragmentation
- Dead Peer Detection (DPD, RFC 3706) takes care of dangling tunnels
- Virtual IP address pool managed by IKE daemon, DHCP, RADIUS or SQL database
- IKEv2 SAs may be redirected to another gateway (RFC 5685)
- Childless IKEv2 SA initiation is supported (RFC 6023)
- Implemented RFCs and Internet Drafts
Modularity
- A modular plugin system offers great extensibility and flexibility
- Plugins can provide crypto algorithms, credentials, authentication methods, configs, access to IPsec and network stacks and more
- Optional built-in integrity and crypto tests for plugins and libraries
Authentication / Cryptography
- Secure IKEv2 EAP user authentication (EAP-SIM, EAP-AKA, EAP-TLS, EAP-TTLS, EAP-PEAP, EAP-MSCHAPv2, etc.)
- Optional relaying of EAP messages to AAA server via EAP-RADIUS plugin
- Support of IKEv2 Multiple Authentication Exchanges (RFC 4739)
- Authentication based on X.509 certificates or pre-shared keys
- Use of strong signature algorithms with Signature Authentication in IKEv2 (RFC 7427)
- Support for CRLs and OCSP (RFC 6960)
- Storage of private keys and certificates on a smartcard (PKCS #11 interface) or protected by a TPM 2.0
- Support of NIST elliptic curve DH groups and ECDSA signatures and certificates
- Support of X25519 elliptic curve DH group (RFC 8031) and Ed25519 signatures and certificates (RFC 8420)
- Support for multiple classic and post-quantum key exchanges (RFC 9370), including ML-KEM (FIPS 203)
- Trusted Network Connect compliant to PB-TNC (RFC 5793), PA-TNC (RFC 5792), PT-TLS (RFC 6876), PT-EAP (RFC 7171) and SWIMA for PA-TNC (RFC 8412)
Portability
- Runs on Linux 2.6, 3.x, 4.x, 5.x and 6.x kernels
- Has been ported to Android, FreeBSD, macOS, iOS and Windows
- Integration into Linux desktops via NetworkManager plugin
- An Android app is available