How to setup IPsec Mobile VPN using IKEv2 with EAP-MSCHAPv2 on PFsense for Remote Access

IKEv2 is supported in current pfSense versions, and one way to make it work is by using EAP-MSCHAPv2 on Azure Cloud with Pfsense firewall

Create a Certificate Authority
Create a Server Certificate
Set up Mobile IPsec for IKEv2+EAP-MSCHAPv2
Mobile Clients
Phase 1
• If there is an existing Mobile IPsec P1 entry, click the Tunnels Tab and edit it there
• Set Key Exchange version to v2
• Set Authentication method to EAP-MSChapv2
• Set My Identifier to Distinguished name and enter in the hostname of the firewall
• Set Peer Identifier to any
• Select the server certificate created previously for My Certificate
• Select the appropriate CA for My Certificate Authority
• Set Encryption algorithm to 3DES or, if there are no iOS/OS X devices, AES 256
• Set Hash algorithm to SHA1, or, if there are no iOS/OS X devices, SHA256
• Set DH key group to 2 (1024 bit)
o Multiple combinations of encryption, hashing, and DH options may be created to accommodate various clients with different requirements. Click Add Algorithm to add more entries.
• Set Lifetime to 28800
• Uncheck Disable Rekey
• Uncheck Disable Reauth
• Check Enable DPD, set for 10 seconds and 5 retries
• Click Save

Phase 2
• Click Show Phase 2 Entries to show the Mobile IPsec Phase 2 list
• Click Add P2 to add a new Phase 2 entry if one does not exist, or click to edit an existing entry
• Set Mode to Tunnel IPv4
• Set Local Network as desired, e.g. LAN subnet
o To pass all traffic, including Internet traffic, across the VPN, set the Local Network to 0.0.0.0/0
• Enter an appropriate Description
• Set Protocol to ESP
• Set Encryption algorithms to AES Auto and if there are iOS/OS X devices, also select 3DES.
• Set Hash algorithms to SHA1 and SHA256
• Set PFS Key Group to off
• Set Lifetime to 3600
• Click Save
Create Client Pre-Shared Keys
Add Firewall Rules for IPsec

[jeuneetambitieux]

my windows does not recognize my hostname. I got this message :
the remote connection was not established because the remote access server name was not resolved.
Can you help me please ?

[romankvapil]

In pfSense 2.6 is not allowed Encryption 3DES and SHA1, how to set then for Windows 10 client ?

[BANKALSTECHZONE]

Hi, I am able to connect ipsec vpn from any vm machine ( windows) but cant connect vpn from any machine .pls.help

[tonychen]

Hi, I tried to set Local Network to 0.0.0.0/0 but looks like the client isn't sending all traffic across the VPN, what else do I have to do?

[PharmDRx]

"Set My Identifier to Distinguished name and enter in the hostname of the firewall"

I do no have this option... I do have "ASN.1 Distinguished Name" ... is that the same? If not then PFsense mustve changed something because I dont have an option that just says "distinguished name"

[terrywang]

Hi, I didn't see how to creare the username and password for IPSEC connect, can you show me? Besides, I also use pfsense 2.6 and can't find the Distinguished name, only have ASN.1 Distinguished Name. When I add a new "Pre-shared Keys", I need to choose "Identifier type", which one I should choose？

[rub]

Hi, thanks for the video I got it working!
Do you know how to do this in androids or Iphones phones? ive been trying to get it my vpn connected in my samsung galaxy 2022 but no luck so far ;/

[astorbg]

Not work. VPN connection is Ok but no Subnet and internet

Ok! I will study this example, and I will try to create a site-to-site tunnel between an On-Premise pfSense and the Azure pfSense. Thank again for the answer.

I have made a first tunnel and with no success, after the video I will review the settings and try again.