StrongSwan

These policies configure the StrongSwan app and its VPN profiles on Android Enterprise devices.

Relution offers two related policies for the StrongSwan → app (org.strongswan.android): StrongSwan Restrictions controls the app’s behavior and references a default profile, while StrongSwan VPN Profile defines the actual IKEv2 VPN connection. Via Always-On VPN →, the StrongSwan app can additionally be set as the permanently active VPN app. Which profile is connected is determined by the Select a Default VPN Profile setting in the StrongSwan Restrictions.

As soon as a policy contains one of the two configurations, Relution automatically installs the StrongSwan app as a required app, grants it the requested permissions and allows it to install certificates. A separate assignment via Manage apps → is not necessary. Any setting stored there for StrongSwan, e.g. a different install type, is overridden.

StrongSwan Restrictions #

• Allow users to create profiles
• Allow users to import profiles
• Allow users to use existing profiles
• Allow users to import certificates
• Allow users to access Settings
• Do not show a warning if the app is not on the device’s power whitelist
• Select a Default VPN Profile (Select button) – reference to a StrongSwan VPN Profile configuration of the same policy version

StrongSwan VPN Profile #

Multiple VPN profiles can be created and managed in the portal. The form consists of the StrongSwan VPN Profile area with the sections General, User Certificate and CA certificate, and the Advanced settings area.

General #

• Name of the profile
• Server – address of the VPN server. The port is set under Advanced settings.
• VPN Type:
  • IKEv2 EAP (Username/Password)
  • IKEv2 Certificate
  • IKEv2 Certificate + EAP (Username/Password)
  • IKEv2 EAP-TLS (Certificate)
  • IKEv2 EAP-TNC (Username/Password)
• Username – only for VPN types with username/password

User Certificate #

This section only appears for VPN types with a certificate. The user certificate is specified here (see Certificate Management →).

CA Certificate #

CA or server certificate used to verify the VPN server.

Advanced Settings #

The Advanced settings area is divided into the following sections.

General #

• Server identity and Client identity
• DNS Servers, MTU of the VPN tunnel device, Port and NAT-T keepalive interval
• Send certificate requests
• Certificate validation via OCSP or CRL, plus Use strict revocation checking
• Use RSA/PSS signatures and Use IPv6 transport addresses

Split Tunneling #

• Subnets to include or exclude
• Block IPv4/IPv6 traffic not destined for the VPN

Proxy #

Host, port and Exclude hosts from proxy.

Applications #

• Only these Apps will use the VPN – only the listed apps use the VPN, all other apps communicate outside the tunnel
• These Apps will not use the VPN – the listed apps communicate outside the tunnel, all other apps use the VPN. If the list remains empty, all traffic is routed through the VPN.

With lockdown mode enabled in Always-On VPN →, apps outside the tunnel only have a network connection if they are set as a lockdown exemption.

Algorithms #

IKEv2 Algorithms and IPsec/ESP Algorithms.

Support #

• Managed devices (Device Owner)
• COPE work profile (Personal Profile Enabled)
• Work profile (Profile Owner/BYOD)