Prerequisites and System Preparation
Before accessing the network configuration tools, ensure that your Ubuntu system is fully updated to receive the latest kernel modules and networking packages. The Gnome Network Settings application relies on specific backend libraries to handle IPsec negotiations, which are typically installed by default in modern desktop releases but may require explicit installation if running a minimal environment. Open a terminal and executesudo apt update && sudo apt upgrade -y to synchronize package lists. Verify that the network-manager-strongswan package is present by running dpkg -l | grep strongswan. If the package is missing, install it using sudo apt install network-manager-strongswan. After installation, restart the NetworkManager service to ensure the plugin is properly registered with the system daemon using sudo systemctl restart NetworkManager. This step is critical because the Gnome UI will not display IPsec options until the underlying service recognizes the plugin.
Accessing Network Configuration
Navigate to the system settings by clicking the network icon in the top-right corner of the screen and selecting "Wired Settings" or "Wi-Fi Settings" depending on your connection type, then click the gear icon to open detailed settings. Alternatively, access the main "Settings" application from the application menu and select "Network" from the sidebar. In the lower-left corner of the Network panel, click the plus (+) button to add a new connection. From the list of available connection types, scroll down and select "IPsec/IKEv2 VPN". This action opens a configuration window specifically designed for the StrongSwan backend. You must enter a descriptive Connection Name, such as "Corporate-VPN", which will appear in your status bar. Enter the Gateway Address provided by your VPN administrator; this is the public IP address or domain name of the IPsec server. Ensure the protocol is set to IKEv2 unless your provider explicitly requires IKEv1, as IKEv2 offers superior mobility and security features supported natively by recent Ubuntu versions.Configuring Authentication and Credentials
The core of the IPsec setup lies in the Authentication tab. Select "Pre-Shared Key" if your provider uses a shared secret string, or "Certificate" if you have been issued client certificates. For most enterprise setups using Pre-Shared Keys, enter the key exactly as provided, paying close attention to case sensitivity and special characters. If using certificates, import the user certificate and private key files via the file browser buttons. In the "Identity" section, specify the User Name if required by the server policy. Some configurations also require a CA Certificate to verify the server's identity; upload this file if your organization provides one to prevent man-in-the-middle attacks. Click "Apply" to save these initial parameters. It is important to note that incorrect credentials here will result in immediate negotiation failures, so double-check all fields before proceeding.Tuning Encryption and Phase Settings
Move to the "Phase1 Algorithms" and "Phase2 Algorithms" tabs to define cryptographic strengths. By default, Gnome selects robust algorithms like AES-256 for encryption and SHA-256 for integrity. These settings are generally secure and recommended for modern deployments. However, if you encounter compatibility issues with older VPN concentrators, you may need to adjust these selections. For example, some legacy systems require AES-128 or SHA-1, though these are less secure. In the "Options" tab, you can configure advanced behaviors such as DPD (Dead Peer Detection) intervals to maintain the tunnel during idle periods. Enable "Use for virtual private network" to route all traffic through the tunnel, or disable it if you only need split tunneling. Review the summary at the bottom of the window to ensure all constraints match your provider's specifications.Connecting and Troubleshooting
Once configured, return to the Network menu and click the newly created VPN connection to initiate the handshake. Monitor the system logs for any errors by opening the Terminal and runningjournalctl -u NetworkManager -f. Look for messages related to charon, the StrongSwan daemon, which will indicate success or failure reasons. Common issues include firewall blocks on UDP ports 500 and 4500, which must be open on both client and server sides. If the connection fails to establish, check the server logs for rejection reasons, often related to mismatched identities or invalid keys. For further assistance with connectivity issues, refer to our guide on Troubleshooting Strongswan to WatchGuard Connection with No Traffic, which covers similar diagnostic steps for enterprise firewalls.
Frequently Asked Questions
Why does my IPsec connection fail immediately after entering credentials?
This usually indicates a mismatch in the pre-shared key or username compared to what the server expects. Verify that there are no trailing spaces in the key field and that the identity matches the certificate subject if using certificate-based auth.
How can I force the use of IKEv1 instead of IKEv2?
In the IPsec VPN configuration window, look for the Protocol dropdown menu and change it from IKEv2 to IKEv1. Note that IKEv1 is deprecated and may not be supported by all modern servers due to security vulnerabilities.
What should I do if the tunnel connects but has no internet access?
Check the routing table by running ip route to see if traffic is being directed to the VPN interface. Ensure that "Use for virtual private network" is enabled in the Options tab, and verify that the server is pushing correct routes via DHCP or static config.
Can I use this method for L2TP/IPsec hybrid connections?
No, the Gnome Network Settings IPsec plugin handles pure IPsec tunnels. For L2TP/IPsec, you must select the "Layer 2 Tunneling Protocol (L2TP)" option when adding a new connection, which uses a different backend stack.
How do I remove a saved IPsec VPN profile?
Navigate to the Network settings, locate the VPN connection in the list, click the three-dot menu icon next to it, and select "Delete". This removes the configuration permanently from the system.