Hi Alan,<div><br></div><div>I was trying to use the eap-sim-pcsc plugin of strongswan and facing some issues while testing it.I came across one of your threads in strongswan mailer list where you mentioned that you used this plugin.I am stuck at one of the parts and getting the following error on the client side:</div>
<div><br></div><div><br></div><div><<</div><div><div>root@ubuntu5-desktop:/home/ubuntu5# ipsec up android</div><div>initiating IKE_SA android[2] to 192.168.1.154</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>sending packet: from 192.168.1.8[500] to 192.168.1.154[500]</div><div>received packet: from 192.168.1.154[500] to 192.168.1.8[500]</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div>
<div>sending cert request for "C=UK, CN=nits"</div><div>establishing CHILD_SA android</div><div>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div>
<div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div><div>parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]</div><div>received end entity cert "C=UK, CN=nits"</div>
<div> using certificate "C=UK, CN=nits"</div><div> using trusted ca certificate "C=UK, CN=nits"</div><div>checking certificate status of "C=UK, CN=nits"</div><div>certificate status is not available</div>
<div> reached self-signed root ca with a path length of 0</div><div>authentication of '192.168.1.154' with RSA signature successful</div><div>server requested EAP_IDENTITY (id 0x00), sending '9404118100734530'</div>
<div>generating IKE_AUTH request 2 [ EAP/RES/ID ]</div><div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div><div>parsed IKE_AUTH response 2 [ EAP/FAIL ]</div>
<div>received EAP_FAILURE, EAP authentication failed</div><div>root@ubuntu5-desktop:/home/ubuntu5# ipsec up android</div><div>initiating IKE_SA android[3] to 192.168.1.154</div><div>generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]</div>
<div>sending packet: from 192.168.1.8[500] to 192.168.1.154[500]</div><div>received packet: from 192.168.1.154[500] to 192.168.1.8[500]</div><div>parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]</div>
<div>sending cert request for "C=UK, CN=nits"</div><div>establishing CHILD_SA android</div><div>generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ IDr SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]</div>
<div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div><div>parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]</div><div>received end entity cert "C=UK, CN=nits"</div>
<div> using certificate "C=UK, CN=nits"</div><div> using trusted ca certificate "C=UK, CN=nits"</div><div>checking certificate status of "C=UK, CN=nits"</div><div>certificate status is not available</div>
<div> reached self-signed root ca with a path length of 0</div><div>authentication of '192.168.1.154' with RSA signature successful</div><div>server requested EAP_IDENTITY (id 0x00), sending '9404118100734530'</div>
<div>generating IKE_AUTH request 2 [ EAP/RES/ID ]</div><div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div><div>parsed IKE_AUTH response 2 [ EAP/REQ/SIM ]</div>
<div>server requested EAP_SIM authentication (id 0xCA)</div><div>generating IKE_AUTH request 3 [ EAP/RES/SIM ]</div><div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div>
<div>parsed IKE_AUTH response 3 [ EAP/REQ/SIM ]</div><div><b>EAP_SIM MAC verification failed</b></div><div>sending client error 'unable to process packet'</div><div>generating IKE_AUTH request 4 [ EAP/RES/SIM ]</div>
<div>sending packet: from 192.168.1.8[4500] to 192.168.1.154[4500]</div><div>received packet: from 192.168.1.154[4500] to 192.168.1.8[4500]</div><div>parsed IKE_AUTH response 4 [ EAP/FAIL ]</div><div><b>received EAP_FAILURE, EAP authentication failed</b></div>
<div>root@ubuntu5-desktop:/home/ubuntu5# </div></div><div>>>></div><div><br></div><div><div>I was wondering if you can suggest if I'm missing something while testing the plugin.My main doubts are:</div></div>
<div><br></div><div>1) Whether the eap-sim-pcsc plugin supports sim card based authentication. If yes, then what should be the username and keys format that needs to be stored on the radius server .</div><div><div>2) Is there any other dependencies for using this plugin?</div>
<div><br></div><div> Thanks</div><div>Deepika</div>-- <br>If you think you can or if you think you can't, you are right.<br>-Henry Ford<br>
</div>