<div dir="ltr">Opps, not quite. My real question is that some weird logs with user name "192.168.3.254" in Radius accounting DB, so I go to check Charon's log, found these logs.<div><br></div><div> </div></div>
<div class="gmail_extra"><br clear="all"><div><br>--<br>Kris</div>
<br><br><div class="gmail_quote">On Sat, Apr 6, 2013 at 11:30 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hmm, are you sure the client in question is sending an EAP identity?<br>
I just checked one of our example RADIUS scenarios<br>
<br>
<a href="http://www.strongswan.org/uml/testresults/ikev2/rw-eap-md5-id-radius/" target="_blank">http://www.strongswan.org/uml/testresults/ikev2/rw-eap-md5-id-radius/</a><br>
<br>
and I see that the gateway nevertheless logs the EAP Identity:<br>
<br>
16[IKE] initiating EAP_IDENTITY method (id 0x00)<br>
16[IKE] authentication of '<a href="http://moon.strongswan.org" target="_blank">moon.strongswan.org</a>' (myself) with RSA<br>
signature successful<br>
16[IKE] sending end entity cert "C=CH, O=Linux strongSwan,<br>
CN=<a href="http://moon.strongswan.org" target="_blank">moon.strongswan.org</a>"<br>
16[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<br>
16[NET] sending packet: from 192.168.0.1[4500] to 192.168.0.100[4500]<br>
(1436 bytes)<br>
<br>
05[NET] received packet: from 192.168.0.100[4500] to 192.168.0.1[4500]<br>
(76 bytes)<br>
05[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]<br>
05[IKE] received EAP identity 'carol'<br>
05[CFG] sending RADIUS Access-Request to server '10.1.0.10'<br>
05[CFG] received RADIUS Access-Challenge from server '10.1.0.10'<br>
05[IKE] initiating EAP_MD5 method (id 0x01)<br>
05[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MD5 ]<br>
05[NET] sending packet: from 192.168.0.1[4500] to 192.168.0.100[4500]<br>
(92 bytes)<br>
<br>
04[NET] received packet: from 192.168.0.100[4500] to 192.168.0.1[4500]<br>
(92 bytes)<br>
04[ENC] parsed IKE_AUTH request 3 [ EAP/RES/MD5 ]<br>
04[CFG] sending RADIUS Access-Request to server '10.1.0.10'<br>
04[CFG] received RADIUS Access-Accept from server '10.1.0.10'<br>
04[IKE] RADIUS authentication of 'carol' successful<br>
04[IKE] EAP method EAP_MD5 succeeded, no MSK established<br>
04[ENC] generating IKE_AUTH response 3 [ EAP/SUCC ]<br>
04[NET] sending packet: from 192.168.0.1[4500] to 192.168.0.100[4500]<br>
(76 bytes)<br>
<br>
03[NET] received packet: from 192.168.0.100[4500] to 192.168.0.1[4500]<br>
(92 bytes)<br>
03[ENC] parsed IKE_AUTH request 4 [ AUTH ]<br>
03[IKE] authentication of '<a href="mailto:carol@strongswan.org">carol@strongswan.org</a>' with EAP successful<br>
03[IKE] authentication of '<a href="http://moon.strongswan.org" target="_blank">moon.strongswan.org</a>' (myself) with EAP<br>
03[IKE] IKE_SA rw-eap[1] established between<br>
192.168.0.1[<a href="http://moon.strongswan.org" target="_blank">moon.strongswan.org</a>]...192.168.0.100[<a href="mailto:carol@strongswan.org">carol@strongswan.org</a>]<br>
<br>
Regards<br>
<br>
Andreas<br>
<div class="im"><br>
On 04/06/2013 05:07 PM, Kris wrote:<br>
> Hi, Andreas<br>
><br>
> Thanks for your explanation. Because there're some logs with username<br>
> '192.168.3.254' in my Radius accounting DB, so I worry about it should<br>
> be the correct username, or not, user's traffic accounting may be not<br>
> accurate.<br>
><br>
> --<br>
> Kris<br>
><br>
><br>
> On Sat, Apr 6, 2013 at 10:43 PM, Andreas Steffen<br>
</div>> <<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a> <mailto:<a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a>>><br>
<div><div class="h5">> wrote:<br>
><br>
> Hi Kris,<br>
><br>
> 192.168.3.254 is just the outer IKEv2 client identity and is<br>
> equivalent to the client IP address in the local LAN behind<br>
> the NAT router. The inner EAP identity is not visible in the gateway<br>
> log because it is handled by the RADIUS server.<br>
><br>
> Don't worry!<br>
><br>
> Andreas<br>
><br>
> On 04/06/2013 04:08 PM, Kris wrote:<br>
> ><br>
> > I got weird log in Strongswan like:<br>
> ><br>
> > Apr 3 06:31:36 13[ENC] parsed IKE_AUTH request 6 [ AUTH ]<br>
> > Apr 3 06:31:36 13[IKE] authentication of '192.168.3.254' with EAP<br>
> > successful<br>
> > Apr 3 06:31:36 13[IKE] authentication of '<a href="http://xx.com" target="_blank">xx.com</a> <<a href="http://xx.com" target="_blank">http://xx.com</a>><br>
> <<a href="http://xx.com" target="_blank">http://xx.com</a>>'<br>
> > (myself) with EAP<br>
> > Apr 3 06:31:36 13[IKE] IKE_SA win7[16115] established between<br>
> > 19.45.16.1[<a href="http://xx.com" target="_blank">xx.com</a> <<a href="http://xx.com" target="_blank">http://xx.com</a>><br>
> <<a href="http://xx.com" target="_blank">http://xx.com</a>>]...12.46.25.8[192.168.3.254]<br>
> ><br>
> > Apr 3 06:31:36 13[IKE] authentication of '192.168.3.254' with EAP<br>
> > successful<br>
> ><br>
> > How could this possible? '192.168.3.254' isn't my Radius' user at all,<br>
> > how could it act like VPN username ?<br>
> ><br>
> > I'm runing 5.0.2dr4, is this a bug or my config mistake?<br>
> ><br>
> > conn win7<br>
> > keyexchange=ikev2<br>
> > left=%any<br>
</div></div>> > leftid=<a href="http://xx.com" target="_blank">xx.com</a> <<a href="http://xx.com" target="_blank">http://xx.com</a>> <<a href="http://xx.com" target="_blank">http://xx.com</a>><br>
> > leftsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<div class="HOEnZb"><div class="h5">> > leftauth=pubkey<br>
> > leftcert=gw.cer<br>
> > right=%any<br>
> > rightsendcert=never<br>
> > rightauth=eap-radius<br>
> > eap_identity=%identity<br>
> > rightsourceip=%ippool<br>
> > ikelifetime=48h<br>
> > lifetime=48h<br>
> > rekeymargin=9m<br>
> > rekey=no<br>
> > reauth=no<br>
> > dpddelay=30<br>
> > dpdtimeout=150<br>
> > dpdaction=clear<br>
> ><br>
> > --<br>
> > Kris<br>
======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Linux VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</div></div></blockquote></div><br></div>