I was exploring the IKEv2 StrongSwan client implementation for Android. What I fail to understand is that Android and Java do not support raw sockets, whilst the IKEv2/IPSec works below the transport layer, which seems counter-intuitive. How exactly does the communication happen after the CHILD_SA aka IPSec SA is established?


  1. The official documentation for IKE Charon keying daemon does mention the use of 'socket' in the architecture diagram, but I was unable to find any further reference to it.
  2. I'm aware of the fact that StrongSwan's Android client uses a user-space implementation of libipsec, but again how does libipsec communicate without raw sockets?

Any help to fill the gap in my understanding is much appreciated!

1 Answer 1


The client only supports UDP-encapsulated ESP. These packets are sent/received over the same UDP sockets that are already used for IKEv2. This limitation is mentioned on the app's wiki page.

  • Probably a correct answer, but would be even better with some references. Commented Jun 19, 2020 at 8:39
  • 5
    Since I'm the app's dev, I can tell you with authority it is :) But I've added a link to the wiki page where I added a note about it (basically the same information, but maybe easier to find for others).
    – ecdsa
    Commented Jun 19, 2020 at 12:47
  • 1
    I am a developer of the OpenConnect VPN client, which also supports several ESP-based VPNs, and I concur that only ESP-over-UDP is supported in Android. Basically all modern client/server VPNs use it anyway, since "plain" ESP-over-IP isn't reliably enough transmitted by middleboxes on the internet.
    – Dan Lenski
    Commented Jun 20, 2020 at 1:57
  • 1
    I'm not exactly sure what you mean, but there is no relation between socket and IKE or Child SA (e.g. strongSwan uses the same socket, no matter how many IKE SAs there are). But if you want to send ESP packets over a different socket, you could modify send_esp() in android_service.c (ESP packets may also be queued to libipsec from other sockets).
    – ecdsa
    Commented Jun 22, 2020 at 7:41
  • 1
    Again, you don't need separate sockets to have multiple IKE SAs with different servers. UDP sockets allow sending packets to arbitrary IP addresses. But note that the Android client currently only supports a single IKE and Child SA.
    – ecdsa
    Commented Jun 22, 2020 at 8:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .