# IPsec with public key authentication on VyOS/EdgeOS
## Setup
### Generate an RSA keypair

```sh
ubnt@ubnt:~$ generate vpn rsa-key bits 4096 random /dev/urandom
Generating rsa-key to /config/ipsec.d/rsa-keys/localhost.key

Your new local RSA key has been generated
The public portion of the key is:

 
```

### Exchange public keys with your peer
1. Display the public key. Send the key data portion to your peer.

```sh
ubnt@ubnt:~$ show vpn ike rsa-keys

Local public key (/config/ipsec.d/rsa-keys/localhost.key):

 
```

2. Convert your peer's public key to the Base64 RFC 3110 format using the [pubkey-converter][pubkey-converter] script, if necessary.

[pubkey-converter]: <https://dn42.us/git/user/ryan/pubkey-converter.git/plain/pubkey-converter.pl> "Public key conversion script"

## Configuration
### Configure the phase 1 IKE parameters
In this example, we'll use the following settings:

| Key           | Value         |
| :------------ | :------------ |
| Encryption    | AES-128       |
| Hash          | HMAC-SHA1     |
| DH Group      | 5 (modp1536)  |
| Lifetime      | 28800 seconds |
| Peer address  | 192.0.2.2     |
| Local address | 192.0.2.1     |

1. Add your peer's public key

```sh
vyos@vyos:~$ configure
[edit]
vyos@vyos# set vpn rsa-keys rsa-key-name my-peer rsa-key  
```

2. Configure an ISAKMP policy

```sh
[edit]
vyos@vyos# edit vpn ipsec ike-group FOO
[edit vpn ipsec ike-group FOO]
vyos@vyos# set lifetime 28800
[edit vpn ipsec ike-group FOO]
vyos@vyos# set proposal 1 encryption aes128
[edit vpn ipsec ike-group FOO]
vyos@vyos# set proposal 1 hash sha1
[edit vpn ipsec ike-group FOO]
vyos@vyos# set proposal 1 dh-group 5
[edit vpn ipsec ike-group FOO]
vyos@vyos# commit
```

3. Set your peer definition to use the public key

```sh
[edit vpn ipsec ike-group FOO]
vyos@vyos# up
[edit vpn ipsec]
vyos@vyos# edit site-to-site peer 192.0.2.2
[edit vpn ipsec site-to-site peer 192.0.2.2]
vyos@vyos# set authentication mode rsa
[edit vpn ipsec site-to-site peer 192.0.2.2]
vyos@vyos# set authentication rsa-key-name my-peer
```

4. All done! Configure the phase 2 parameters as you otherwise would.

## Full GRE/IPsec example

```conf    
interfaces {
    ethernet eth0 {
        address 192.0.2.1/30
        description WAN
        duplex auto
        speed auto
    }
    tunnel tun0 {
        address 10.1.2.0/31
        encapsulation gre
        local-ip 192.0.2.1
        mtu 1400
        multicast disable
        remote-ip 192.0.2.2
        ttl 255
    }
}
vpn {
    ipsec {
        esp-group BAR {
            compression disable
            lifetime 3600
            mode transport
            pfs dh-group5
            proposal 1 {
                encryption aes128
                hash sha1
            }
        }
        ike-group FOO {
            lifetime 28800
            proposal 1 {
                dh-group 5
                encryption aes128
                hash sha1
            }
        }
        ipsec-interfaces {
            interface eth0
        }
        site-to-site {
            peer 192.0.2.2 {
                authentication {
                    mode rsa
                    rsa-key-name my-peer
                }
                connection-type initiate
                default-esp-group BAR
                ike-group FOO
                local-ip 192.0.2.1
                tunnel 0 {
                    protocol gre
                }
            }
        }
    }
    rsa-keys {
        rsa-key-name my-peer {
            rsa-key  
        }
    }
}
```
