Hi Again,<br><br>In fact I see eap-radius configuration in strongswan.conf in not picked up. <br> Sep 5 10:42:01 00[CFG] loaded 0 RADIUS server configurations<br><br>See the log below when I just started ipsec. I appreciate any tips why Radius server configuration is not loaded.<br>
<br>Sep 5 10:42:01 00[DMN] Starting IKE charon daemon (strongSwan 5.0.0, Linux 2.6.34, x86_64)<br>Sep 5 10:42:01 00[KNL] listening on interfaces:<br>Sep 5 10:42:01 00[KNL] fpn0<br>Sep 5 10:42:01 00[KNL] fe80::200:46ff:fe50:4e00<br>
Sep 5 10:42:01 00[KNL] ethernet1<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b96<br>Sep 5 10:42:01 00[KNL] ethernet2<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b97<br>Sep 5 10:42:01 00[KNL] ethernet3<br>
Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b98<br>Sep 5 10:42:01 00[KNL] ethernet4<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b99<br>Sep 5 10:42:01 00[KNL] ethernet5<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b9a<br>
Sep 5 10:42:01 00[KNL] ethernet6<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b9b<br>Sep 5 10:42:01 00[KNL] ethernet7<br>Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b9c<br>Sep 5 10:42:01 00[KNL] ethernet8<br>
Sep 5 10:42:01 00[KNL] fe80::210:f3ff:fe24:5b9d<br>Sep 5 10:42:01 00[CFG] loaded 0 RADIUS server configurations<br>Sep 5 10:42:01 00[CFG] loading ca certificates from '/etc/ipsec.d/cacerts'<br>Sep 5 10:42:01 00[CFG] loading aa certificates from '/etc/ipsec.d/aacerts'<br>
Sep 5 10:42:01 00[CFG] loading ocsp signer certificates from '/etc/ipsec.d/ocspcerts'<br>Sep 5 10:42:01 00[CFG] loading attribute certificates from '/etc/ipsec.d/acerts'<br>Sep 5 10:42:01 00[CFG] loading crls from '/etc/ipsec.d/crls'<br>
Sep 5 10:42:01 00[CFG] loading secrets from '/etc/ipsec.secrets'<br>....<br>Thanks!<br>Jordan.<br><div class="gmail_quote">On Tue, Sep 4, 2012 at 11:03 AM, yordanos beyene <span dir="ltr"><<a href="mailto:yordanosb@gmail.com" target="_blank">yordanosb@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi SS team,<br><br>I finally resolved the SS5 kernel error with Martin tips, and charon is up and running. I can establish site-to-site tunnels with IKEv1 and IKev2. Remote vpn works with users authenticated locally. But I can't get users to authenticate via eap-radius.<br>
<br>Here is the error message:<br>Sep 5 01:11:47 15[IKE] received EAP identity 'jordan'<br>Sep 5 01:11:47 15[IKE] loading EAP_RADIUS method failed<br><br>Can you please provide me any tips? Did I miss any plugins? <br>
<br>I have included vpn logs and configuration details below.<br><br>Thanks as always for your help.<br><br>Jordan.<br>vpn.log:<br><br>Sep 5 01:11:36 00[DMN] loaded plugins: charon random nonce x509 revocation constraints pubkey pkcs1 pkcs8 pgp dnskey pem xcbc cmac hmac attr kernel-netlink resolve socket-default stroke updown xauth-generic xauth-eap openssl eap-identity sha1 fips-prf eap-mschapv2 eap-radius eap-md5 eap-aka eap-aka-3gpp2 eap-simaka-pseudonym eap-simaka-reauth<br>
Sep 5 01:11:36 00[JOB] spawning 16 worker threads<br>Sep 5 01:11:36 14[CFG] received stroke: add connection 'rw-ikev2'<br>Sep 5 01:11:36 14[CFG] loaded certificate "C=US, ST=CA, O=RS, OU=SPG, CN=<a href="http://zeus.test.com" target="_blank">zeus.test.com</a>, E=<a href="mailto:zeus@test.com" target="_blank">zeus@test.com</a>" from 'zeus2.pem'<br>
Sep 5 01:11:36 14[CFG] added configuration 'rw-ikev2'<br>Sep 5 01:11:36 14[CFG] adding virtual IP address pool 'rw-ikev2': <a href="http://192.16.80.10/24" target="_blank">192.16.80.10/24</a><br>Sep 5 01:11:47 12[NET] received packet: from 172.16.50.20[500] to 172.16.20.2[500]<br>
Sep 5 01:11:47 12[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>Sep 5 01:11:47 12[IKE] 172.16.50.20 is initiating an IKE_SA<br>Sep 5 01:11:47 12[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<br>
Sep 5 01:11:47 12[NET] sending packet: from 172.16.20.2[500] to 172.16.50.20[500]<br>Sep 5 01:11:47 10[NET] received packet: from 172.16.50.20[4500] to 172.16.20.2[4500]<br>Sep 5 01:11:47 10[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CP(ADDR DNS NBNS SRV) SA TSi TSr ]<br>
Sep 5 01:11:47 10[IKE] received 34 cert requests for an unknown ca<br>Sep 5 01:11:47 10[CFG] looking for peer configs matching 172.16.20.2[%any]...172.16.50.20[172.16.50.20]<br>Sep 5 01:11:47 10[CFG] selected peer config 'rw-ikev2'<br>
Sep 5 01:11:47 10[IKE] initiating EAP_IDENTITY method (id 0x00)<br>Sep 5 01:11:47 10[IKE] peer supports MOBIKE, but disabled in config<br>Sep 5 01:11:47 10[IKE] authentication of '<a href="http://zeus.hp.com" target="_blank">zeus.hp.com</a>' (myself) with RSA signature successful<br>
Sep 5 01:11:47 10[IKE] sending end entity cert "C=US, ST=CA, O=RS, OU=SPG, CN=<a href="http://zeus.test.com" target="_blank">zeus.test.com</a>, E=<a href="mailto:zeus@test.com" target="_blank">zeus@test.com</a>"<br>
Sep 5 01:11:47 10[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<br>
Sep 5 01:11:47 10[NET] sending packet: from 172.16.20.2[4500] to 172.16.50.20[4500]<br>Sep 5 01:11:47 15[NET] received packet: from 172.16.50.20[4500] to 172.16.20.2[4500]<br>Sep 5 01:11:47 15[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]<br>
Sep 5 01:11:47 15[IKE] received EAP identity 'jordan'<br>Sep 5 01:11:47 15[IKE] loading EAP_RADIUS method failed<br>Sep 5 01:11:47 15[ENC] generating IKE_AUTH response 2 [ EAP/FAIL ]<br>Sep 5 01:11:47 15[NET] sending packet: from 172.16.20.2[4500] to 172.16.50.20[4500]<div>
<br>ipsec.conf<br><br># /etc/ipsec.conf - strongSwan IPsec configuration file<br><br>config setup<br><br>conn %default<br> ikelifetime=60m<br> keylife=20m<br> rekeymargin=3m<br> keyingtries=1<br>
authby=secret<br> mobike=no<br><br>conn rw-ikev2<br> keyexchange=ikev2<br> left=172.16.20.2<br> leftcert=zeus2.pem<br> leftid=@<a href="http://zeus.test.com" target="_blank">zeus.test.com</a><br>
leftauth=pubkey<br> leftsubnet=<a href="http://172.16.40.0/24" target="_blank">172.16.40.0/24</a><br> right=%any<br> rightsourceip=<a href="http://192.16.80.10/24" target="_blank">192.16.80.10/24</a><br>
rightauth=eap-radius<br>
eap_identity=%any<br> auto=add <br></div><br>
</blockquote></div><br>