netfoundry / ansible-role-strongswan

Ansible role for configuring strongSwan on Debian or EL (CentOS, RedHat)

Ansible strongSwan Role

An Ansible role for the configuration of strongSwan with support for Ubuntu, EL.

Requirements

Role Variables

# defaults/main.yml
strongswan_conn_default:
  auto: add
  authby: psk
  keyexchange: ikev2
  dpdaction: restart
  dpddelay: 30
  left:
    address: "%any"
  right:
    address: "%any"

strongswan_conn: []

strongswan_charondebug: "cfg 2, dmn 2, ike 2, net 0"

Connection information to be installed into strongSwan:

strongswan_conn:
  - name: dpt-1-server
    conn:
      auto: add
      type: tunnel
      authby: psk
      keyexchange: ikev1
    left:
      address: 1.2.3.4
      firewall: "yes"
      hostaccess: "yes"
    right:
      address: "%any"
    secret: test

Example Playbook

IKEv1:

- hosts: servers
  roles:
    - role: strongswan
      vars:
        strongswan_conn:
          - name: dpt-1-server
            conn:
              auto: add
              type: tunnel
              authby: psk
              keyexchange: ikev1
            left:
              address: 1.2.3.4
              firewall: "yes"
              hostaccess: "yes"
            right:
              address: "%any"
            credentials:
              - type: PSK
                secret: test

IKEv2:

- hosts: servers
  roles:
    - role: strongswan
      vars:
        strongswan_conn:
          - name: dpt-1-server
            conn:
              auto: add
              type: tunnel
              keyexchange: ikev2
            left:
              address: 1.2.3.4
              subnet: 0.0.0.0/0
              cert: server-cert.pem
              firewall: "yes"
            right:
              auth: eap-radius
            credentials:
              - type: RSA
                secret: server-key.pem
        plugins:
          - filename: eap-radius.conf
            config:
              block: |
                  server-0 {
                      address = 127.0.0.1
                      secret = test
                  }
              insertafter: 'servers \{'

Certificates and keys have to be provided manually in:

• /etc/ipsec.d/certs/
• /etc/ipsec.d/private/

License

GPLv2