<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
<br>I'm connecting to a Cisco router which query for the EAP identity<br><br>The router sends:<br>*Jul 10 11:44:01.237: IKEv2:(SA ID = 1):Building packet for encryption. <br>Payload contents: <br> VID Next payload: IDr, reserved: 0x0, length: 20<br> IDr Next payload: CERT, reserved: 0x0, length: 74<br> Id type: DER ASN1 DN, Reserved: 0x0 0x0<br> CERT Next payload: AUTH, reserved: 0x0, length: 865<br> Cert encoding X.509 Certificate - signature<br> AUTH Next payload: EAP, reserved: 0x0, length: 264<br> Auth method RSA, reserved: 0x0, reserved 0x0<br> EAP Next payload: NONE, reserved: 0x0, length: 10<br> Code: request: id: 59, length: 6<br> Type: identity<br> <br>and I get a NAK from the strongswan<br><br><br><br>Jul 10 13:32:26 ironmaiden charon: 13[IKE] authentication of 'CN=10.1.1.254, OU=TAC, O=Cisco, C=BE' with RSA signature successful<br>Jul 10 13:32:26 ironmaiden charon: 13[IKE] server requested EAP_IDENTITY, sending 'cisco'<br>Jul 10 13:32:26 ironmaiden charon: 13[IKE] EAP_IDENTITY not supported, sending EAP_NAK<br>Jul 10 13:32:26 ironmaiden charon: 13[IKE] reinitiating already active tasks<br>Jul 10 13:32:26 ironmaiden charon: 13[IKE] IKE_AUTHENTICATE task<br>Jul 10 13:32:26 ironmaiden charon: 13[ENC] added payload of type EXTENSIBLE_AUTHENTICATION to message<br>Jul 10 13:32:26 ironmaiden charon: 13[ENC] added payload of type EXTENSIBLE_AUTHENTICATION to message<br>Jul 10 13:32:26 ironmaiden charon: 13[ENC] generating IKE_AUTH request 2 [ EAP/RES/NAK ]<br>Jul 10 13:32:26 ironmaiden charon: 13[ENC] insert payload EXTENSIBLE_AUTHENTICATION to encryption payload<br><br><br>conn cisco<br> left=10.1.1.1<br> right=10.1.1.254<br> keyexchange=ikev2<br> ike=3des-sha1-modp1024<br> esp=aes-sha1<br> leftauth=eap-mschapv2<br> leftid=10.1.1.1<br> eap_identity=cisco<br> rightsubnet=0.0.0.0/0<br> auto=start<br> mobike=no<br><br><br><br>This config works well with a true windows7 client.... Why EAP-Identity is not supported?<br><br><br><div><hr id="stopSpelling">From: olivier_pelerin@hotmail.com<br>To: users@lists.strongswan.org<br>Date: Sun, 10 Jul 2011 13:06:11 +0200<br>Subject: Re: [strongSwan] trying to configure strongswan to act like a windows7 client<br><br>
<meta http-equiv="Content-Type" content="text/html; charset=unicode">
<meta name="Generator" content="Microsoft SafeHTML">
<style>
.ExternalClass .ecxhmmessage P
{padding:0px;}
.ExternalClass body.ecxhmmessage
{font-size:10pt;font-family:Tahoma;}
</style>
<div dir="ltr">
Ok I think I've found it<br><br>http://www.strongswan.org/uml/testresults/ikev2/rw-eap-mschapv2-id-rsa/index.html<br><br>Let me play a bit<br><br><br><br><div><hr id="ecxstopSpelling">From: olivier_pelerin@hotmail.com<br>To: users@lists.strongswan.org<br>Subject: trying to configure strongswan to act like a windows7 client<br>Date: Sun, 10 Jul 2011 11:57:57 +0200<br><br>
<style>
.ExternalClass .ecxhmmessage P
{padding:0px;}
.ExternalClass body.ecxhmmessage
{font-size:10pt;font-family:Tahoma;}
</style>
<div dir="ltr">
Hello,<br><br><br>I would like to emulate a windows7 ikev2 client by using strongswan. Does anyone have an idea?<br><br>Cheers,<br> </div></div> </div>
<br>_______________________________________________
Users mailing list
Users@lists.strongswan.org
https://lists.strongswan.org/mailman/listinfo/users</div> </div></body>
</html>