<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 10pt;
font-family:Tahoma
}
--></style>
</head>
<body class='hmmessage'><div dir='ltr'>
Many thanks Andreas, I've reemerged the package with the proper USE flags on my gentoo linux<br><br>EAP now is succesful. However I'm getting the following error message<br><br>Jul 11 11:54:06 ironmaiden charon: 16[ENC] found payload of type SECURITY_ASSOCIATION<br>Jul 11 11:54:06 ironmaiden charon: 16[ENC] found payload of type TRAFFIC_SELECTOR_INITIATOR<br>Jul 11 11:54:06 ironmaiden charon: 16[ENC] found payload of type TRAFFIC_SELECTOR_RESPONDER<br>Jul 11 11:54:06 ironmaiden charon: 16[ENC] parsed IKE_AUTH response 5 [ AUTH SA TSi TSr N(SET_WINSIZE) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) ]<br>Jul 11 11:54:06 ironmaiden charon: 16[IKE] received SET_WINDOW_SIZE notify<br>Jul 11 11:54:06 ironmaiden charon: 16[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED notify<br>Jul 11 11:54:06 ironmaiden charon: 16[IKE] received NON_FIRST_FRAGMENTS_ALSO notify<br>Jul 11 11:54:06 ironmaiden charon: 16[IKE] authentication of 'CN=10.1.1.254, OU=TAC, O=Cisco, C=BE' with EAP successful<br>Jul 11 11:54:06 ironmaiden charon: 16[CFG] constraint check failed: identity 'C=BE, O=CISCO, OU=TAC, CN=10.1.1.254' required <br>Jul 11 11:54:06 ironmaiden charon: 16[CFG] selected peer config 'C=BE,O=CISCO,OU=TAC,CN=10.1.1.254' inacceptable<br>Jul 11 11:54:06 ironmaiden charon: 16[CFG] no alternative config found<br>Jul 11 11:54:06 ironmaiden charon: 16[KNL] deleting SAD entry with SPI ce5058a0<br>Jul 11 11:54:06 ironmaiden charon: 16[KNL] deleted SAD entry with SPI ce5058a0<br>Jul 11 11:54:06 ironmaiden charon: 16[IKE] IKE_SA C=BE,O=CISCO,OU=TAC,CN=10.1.1.254[1] state change: CONNECTING => DESTROYING<br>Jul 11 11:54:10 ironmaiden charon: 01[JOB] got event, queuing job for execution<br><br>Why my peer config is unacceptable?<br><br>ironmaiden strongswan_ikev2 # cat /etc/ipsec.conf <br># ipsec.conf - strongSwan IPsec configuration file<br><br># basic configuration<br><br>config setup<br> charondebug="ike 2, chd 2, job 2, cfg 2, knl 2, net 2, enc 2, lib 2"<br> crlcheckinterval=600<br> # strictcrlpolicy=yes<br> # cachecrls=yes<br> # nat_traversal=yes<br> charonstart=yes<br> plutostart=yes<br># Add connections here.<br>conn "C=BE,O=CISCO,OU=TAC,CN=10.1.1.254"<br> left=10.1.1.1<br> right=10.1.1.254<br> keyexchange=ikev2<br> ike=3des-sha1-modp1024<br> esp=aes-sha1<br> leftauth=eap-mschapv2<br> leftid=cisco<br> rightid="C=BE,O=CISCO,OU=TAC,CN=10.1.1.254"<br> eap_identity=cisco<br> rightsubnet=0.0.0.0/0<br> auto=start<br> mobike=no<br><br>I've tried various rightid's but it never went ok.<br><br><br><br><div>> Date: Sun, 10 Jul 2011 21:47:36 +0200<br>> From: andreas.steffen@strongswan.org<br>> To: olivier_pelerin@hotmail.com<br>> CC: users@lists.strongswan.org<br>> Subject: Re: [strongSwan] trying to configure strongswan to act like a windows7 client<br>> <br>> Hello Olivier,<br>> <br>> you must enable and load the eap-identity module:<br>> <br>> ./configure --enable-eap-identity --enable-eap-mschapv2<br>> <br>> After starting strongSwan the command<br>> <br>> ipsec statusall<br>> <br>> should list the eap-identity and eap-mschapv2 plugins.<br>> <br>> Regards<br>> <br>> Andreas<br>> <br>> On 07/10/2011 01:46 PM, Olivier PELERIN wrote:<br>> ><br>> > I'm connecting to a Cisco router which query for the EAP identity<br>> ><br>> > The router sends:<br>> > *Jul 10 11:44:01.237: IKEv2:(SA ID = 1):Building packet for encryption.<br>> > Payload contents:<br>> > VID Next payload: IDr, reserved: 0x0, length: 20<br>> > IDr Next payload: CERT, reserved: 0x0, length: 74<br>> > Id type: DER ASN1 DN, Reserved: 0x0 0x0<br>> > CERT Next payload: AUTH, reserved: 0x0, length: 865<br>> > Cert encoding X.509 Certificate - signature<br>> > AUTH Next payload: EAP, reserved: 0x0, length: 264<br>> > Auth method RSA, reserved: 0x0, reserved 0x0<br>> > EAP Next payload: NONE, reserved: 0x0, length: 10<br>> > Code: request: id: 59, length: 6<br>> > Type: identity<br>> ><br>> > and I get a NAK from the strongswan<br>> ><br>> ><br>> ><br>> > Jul 10 13:32:26 ironmaiden charon: 13[IKE] authentication of<br>> > 'CN=10.1.1.254, OU=TAC, O=Cisco, C=BE' with RSA signature successful<br>> > Jul 10 13:32:26 ironmaiden charon: 13[IKE] server requested<br>> > EAP_IDENTITY, sending 'cisco'<br>> > Jul 10 13:32:26 ironmaiden charon: 13[IKE] EAP_IDENTITY not supported,<br>> > sending EAP_NAK<br>> > Jul 10 13:32:26 ironmaiden charon: 13[IKE] reinitiating already active tasks<br>> > Jul 10 13:32:26 ironmaiden charon: 13[IKE] IKE_AUTHENTICATE task<br>> > Jul 10 13:32:26 ironmaiden charon: 13[ENC] added payload of type<br>> > EXTENSIBLE_AUTHENTICATION to message<br>> > Jul 10 13:32:26 ironmaiden charon: 13[ENC] added payload of type<br>> > EXTENSIBLE_AUTHENTICATION to message<br>> > Jul 10 13:32:26 ironmaiden charon: 13[ENC] generating IKE_AUTH request 2<br>> > [ EAP/RES/NAK ]<br>> > Jul 10 13:32:26 ironmaiden charon: 13[ENC] insert payload<br>> > EXTENSIBLE_AUTHENTICATION to encryption payload<br>> ><br>> ><br>> > conn cisco<br>> > left=10.1.1.1<br>> > right=10.1.1.254<br>> > keyexchange=ikev2<br>> > ike=3des-sha1-modp1024<br>> > esp=aes-sha1<br>> > leftauth=eap-mschapv2<br>> > leftid=10.1.1.1<br>> > eap_identity=cisco<br>> > rightsubnet=0.0.0.0/0<br>> > auto=start<br>> > mobike=no<br>> ><br>> ><br>> ><br>> > This config works well with a true windows7 client.... Why EAP-Identity<br>> > is not supported?<br>> ><br>> ><br>> > ------------------------------------------------------------------------<br>> > From: olivier_pelerin@hotmail.com<br>> > To: users@lists.strongswan.org<br>> > Date: Sun, 10 Jul 2011 13:06:11 +0200<br>> > Subject: Re: [strongSwan] trying to configure strongswan to act like a<br>> > windows7 client<br>> ><br>> > Ok I think I've found it<br>> ><br>> > http://www.strongswan.org/uml/testresults/ikev2/rw-eap-mschapv2-id-rsa/index.html<br>> ><br>> > Let me play a bit<br>> ><br>> ><br>> ><br>> > ------------------------------------------------------------------------<br>> > From: olivier_pelerin@hotmail.com<br>> > To: users@lists.strongswan.org<br>> > Subject: trying to configure strongswan to act like a windows7 client<br>> > Date: Sun, 10 Jul 2011 11:57:57 +0200<br>> ><br>> > Hello,<br>> ><br>> ><br>> > I would like to emulate a windows7 ikev2 client by using strongswan.<br>> > Does anyone have an idea?<br>> ><br>> > Cheers,<br>> <br>> ======================================================================<br>> Andreas Steffen andreas.steffen@strongswan.org<br>> strongSwan - the Linux VPN Solution! www.strongswan.org<br>> Institute for Internet Technologies and Applications<br>> University of Applied Sciences Rapperswil<br>> CH-8640 Rapperswil (Switzerland)<br>> ===========================================================[ITA-HSR]==<br></div> </div></body>
</html>