[MT]: Move from PSK to PUBKEY auth in L2TP/IPSec case

# Using PUBKEY AUTH instead of PSK (L2TP)
# Link: https://dn42.net/howto/IPsecWithPublicKeys/strongSwan5Example
# 0. Assume you allready have ipsec-psk config:
# MT Side
interface l2tp-client add add-default-route=yes allow=mschap2 allow-fast-path=yes comment="=TEST=" connect-to=<rem-hostname> dial-on-demand=no disabled=no keepalive-timeout=25 max-mru=1424 \
max-mtu=1424 mrru=1618 name=vpn0 profile=default use-ipsec=yes ipsec-secret="very-big-psk-key" user=l2tp-user password="l2tp-password"

# 1. Generate keys
# 1.1 Linux side
ipsec pki --gen -t rsa -f pem -s 2048 > /etc/ipsec.d/private/ipsec-host-rsa-key.pem
ipsec pki --pub --in /etc/ipsec.d/private/ipsec-host-rsa-key.pem --outform pem > /etc/ipsec.d/public/ipsec-host-rsa-pub.pem
echo "<LOCAL-IP> %any : RSA ipsec-host-rsa-key.pem" >> /etc/ipsec.secrets
# MT side
# Generate private key
ip ipsec key generate-key name=ipsec-host-rsa-key key-size=2048
# 1.2 Export public key
ip ipsec key export-pub-key key=ipsec-host-rsa-key file-name=pub/ipsec-host-rsa-pub.pem

# 2. Pubkey exchange
# 2.1 Linux side
# Copy local pubkey to MT
scp /etc/ipsec.d/public/ipsec-host-rsa-key.pem user@172.16.1.20:/pub/ipsec-our-hostname-pub.pem
# Copy remote pubkey from MT
scp user@172.16.1.20:/pub/ipsec-host-rsa-pub.pem /etc/ipsec.d/public/ipsec-rem-hostname.pem
# 2.2 Check
ls -1 /etc/ipsec.d/public/
ipsec-host-rsa-key.pem
ipsec-rem-hostname-key.pem

# 2.3 MT Side
# Import remote side keys
ip ipsec key import pub/ipsec-vc.gw.lt-pub.pem name=ipsec-rem-hostname-pub
# 2.4 Check
ip ipsec key print
Flags: P - private-key, R - rsa
#    NAME                       KEY-SIZE
0 PR ipsec-host-rsa-key         2048-bit
1  R ipsec-rem-hostname-pub     2048-bit

# 3. Ipsec peer / policy
# 3.1 MT Side - copy dynamic peer (policy will be generated automaticaly), because we're lazy.
# ip ipsec peer print detail & get config for required peer
# Change l2tp-client configuration to: use-ipsec=yes ipsec-secret=""
interface l2tp-client disable vpn0
interface l2tp-client set vpn0 ipsec-secret=""
# Add static ipsec peer where:
# - key = our private key;
# - remote-key = remote public key.
ip ipsec peer add address=<REMOTE-IP>/32 auth-method=rsa-key disabled=no exchange-mode=main generate-policy=port-strict key=ipsec-host-rsa-key policy-template-group=default profile=default remote-key=ipsec-rem-hostname-pub send-initial-contact=yes
interface l2tp-client enable vpn0
# 3.2 Linux side
# I won't show my config to you - but, I will :)
cat /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
# man 5 ipsec.conf
# GLOBAL
config setup
        strictcrlpolicy=yes
        uniqueids = yes
# CONNCETIONS
# DEFAULTS FOR IKEv1/L2TP (PSK)
conn ikev1-L2TP
        # PHASE #1
        keyexchange = ikev1     # ike - both / ikev1 / ikev2
        aggressive = no
        authby = psk
        ike = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes256-sha512-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha512-modp2048,aes128-sha256-modp2048,aes128-sha1-modp2048,aes128-sha512-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
        ikelifetime = 3h
        dpdaction = clear       # none / hold / restart
        dpddelay = 30s
        dpdtimeout = 120s       # 150s
        inactivity = 1200s      # should be < CHILD_SA rekeying
        # PHASE #2
        esp = aes256-sha512-modp2048,aes256-sha256-modp2048,aes256-sha1-modp2048,aes256-sha512-modp1024,aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha512-modp2048,aes128-sha256-modp2048,aes128-sha1-modp2048,aes128-sha512-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,3des-sha1-modp1024!
        lifetime = 30m
        type = transport
        sha256_96 = yes
        # POLICY
        left = <LOCAL-IP>
        leftsubnet = <LOCAL-IP>[udp/1701]
        right = %any
        rightsourceip = %config
        rightsubnet = 0.0.0.0/0[udp/1701]
        # START
        auto = add              # route / start
        rekey = yes
# PEERS
conn ikev1-L2TP-peer-LOCATION
        # INCLUDE
        also = ikev1-L2TP
        # PHASE #1
        authby = pubkey
        leftrsasigkey=/etc/ipsec.d/public/ipsec-host-rsa-key.pem
        rightrsasigkey=/etc/ipsec.d/public/ipsec-<location>-key.pem
        # POLICY
        right = <REMOTE-IP>
# END