Subject: [Nea] strongSwan IKEv2 daemon implements RFC 5793 PB-TNC protocol

From: Andreas Steffen <[email-masked]>
Date: Tue, 14 Dec 2010 22:39:51 +0100

Hello,

I'd like to announce that the Open Source strongSwan VPN software
running on the Linux, FreeBSD, Mac OS X and Android operating systems
now fully implements the RFC 5793 PB-TNC protocol.

strongSwan can be configured as

- an IKEv2 VPN Client with an integrated Posture Broker Client

- an IKEv2 VPN Gateway with an integrated Posture Broker Server

- an IKE2v2 VPN Policy Enforcement Point with an EAP-RADIUS
  interface connecting to a remote AAA Server (e.g. FreeRADIUS).

Since the IETF hasn't decided on a PT transport protocol yet,
strongSwan currently uses EAP-TNC, specified by the TCG in

  IF-T Protocol Bindings for Tunneled EAP Methods version 1.1

As an outer tunneling protocol IKEv2-EAP-TTLS is used with
either password-based EAP-MD5 phase 2 client authentication
as in this example scenario:

http://www.strongswan.org/uml/testresults45dr/ikev2/rw-eap-tnc-20/

or certificate-based EAP-TLS authentication as in:

http://www.strongswan.org/uml/testresults45dr/ikev2/rw-eap-tnc-20-tls/

Any Posture Collectors and Posture Validators that adhere to
the TCG's IF-IMC 1.2 and IF-IMV 1.2 interface specifications,
respectively, can be loaded by strongSwan via /etc/tnc_config.

Subscribers of the NEA mailing list interested in testing strongSwan
with their own RFC 5793 implementation (e.g. s PB-TNC enabled
AAA server) can download the current developers release from
our website:

http://download.strongswan.org/strongswan-4.5.1dr2.tar.bz2

The stable strongSwan 4.5.1 version is expected to be released
at the end of January 2011.

The following HOWTO on our Wiki gives some configuration hints:

http://wiki.strongswan.org/projects/strongswan/wiki/TrustedNetworkConnect

We would be very interested in getting some interoperability feedback
from the list.

Kind regards

Andreas Steffen

======================================================================
Andreas Steffen                         [email-masked]
strongSwan - the Linux VPN Solution!                www.strongswan.org
Institute for Internet Technologies and Applications
University of Applied Sciences Rapperswil
CH-8640 Rapperswil (Switzerland)
===========================================================[ITA-HSR]==