<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=windows-1256"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Sprechblasentext Zchn";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.SprechblasentextZchn
{mso-style-name:"Sprechblasentext Zchn";
mso-style-priority:99;
mso-style-link:Sprechblasentext;
font-family:"Tahoma","sans-serif";}
p.msochpdefault, li.msochpdefault, div.msochpdefault
{mso-style-name:msochpdefault;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Calibri","sans-serif";}
span.e-mailformatvorlage17
{mso-style-name:e-mailformatvorlage17;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.E-MailFormatvorlage21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.E-MailFormatvorlage22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.E-MailFormatvorlage23
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=DE link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>Hi all,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>i now collected some Logs on the SWAN Server. Maybe you can see something what I have overseen.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>For me it looks like that the TLS connection to the radius server is not working as expected. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>The other side is, that a Windows Client works as expected.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[NET] received packet: from 2.240.209.118[54149] to 10.10.39.2[500] (712 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 2.240.209.118 is initiating an IKE_SA<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] IKE_SA (unnamed)[185] state change: CREATED => CONNECTING<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_chunk => 22 bytes @ 0x7f3718025bd0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 53 06 1B 1E 26 F0 62 48 00 00 00 00 00 00 00 00 S...&.bH........<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 0A 0A 27 02 01 F4 ..'...<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_hash => 20 bytes @ 0x7f371800fd50<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: AD 7B FD EF 10 12 23 F4 5A 6D EE 06 8B 61 17 B9 .{....#.Zm...a..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 07 0E CD 2C ...,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_chunk => 22 bytes @ 0x7f3718025bd0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 53 06 1B 1E 26 F0 62 48 00 00 00 00 00 00 00 00 S...&.bH........<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 02 F0 D1 76 D3 85 ...v..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_hash => 20 bytes @ 0x7f3718016eb0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: ED D3 CC 6E 30 B3 4C 06 3F 2B DB 0F 51 2B 79 B3 ...n0.L.?+..Q+y.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 9D B3 0C 8E ....<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] precalculated src_hash => 20 bytes @ 0x7f3718016eb0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: ED D3 CC 6E 30 B3 4C 06 3F 2B DB 0F 51 2B 79 B3 ...n0.L.?+..Q+y.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 9D B3 0C 8E ....<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] precalculated dst_hash => 20 bytes @ 0x7f371800fd50<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: AD 7B FD EF 10 12 23 F4 5A 6D EE 06 8B 61 17 B9 .{....#.Zm...a..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 07 0E CD 2C ...,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] received src_hash => 20 bytes @ 0x7f3718011d40<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 04 AE 4E 97 B8 D6 09 2C 28 10 C1 0C B8 36 91 F8 ..N....,(....6..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 62 2B 8C 4A b+.J<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] received dst_hash => 20 bytes @ 0x7f3718011870<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: AA BD ED AC 45 C6 5B 1E AA 0F 55 B0 F3 C5 8C 47 ....E.[...U....G<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 5D AE 0D 20 ].. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] local host is behind NAT, sending keep alives<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] remote host is behind NAT<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_chunk => 22 bytes @ 0x7f3718025660<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 53 06 1B 1E 26 F0 62 48 6C 57 EA A9 98 50 BC B1 S...&.bHlW...P..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 0A 0A 27 02 01 F4 ..'...<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_hash => 20 bytes @ 0x7f371801e280<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 75 E2 B2 1D 6A FA 2B 95 D0 43 4A F2 42 7E 7C D9 u...j.+..CJ.B~|.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 71 19 24 F1 q.$.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_chunk => 22 bytes @ 0x7f3718024060<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 53 06 1B 1E 26 F0 62 48 6C 57 EA A9 98 50 BC B1 S...&.bHlW...P..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: 02 F0 D1 76 D3 85 ...v..<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] natd_hash => 20 bytes @ 0x7f371801e280<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 0: 4C 95 2A F1 88 E7 2C 63 33 9E F8 90 E1 6B E2 52 L.*...,c3....k.R<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[IKE] 16: AE F7 EC 5F ..._<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(MULT_AUTH) ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 13[NET] sending packet: from 10.10.39.2[500] to 2.240.209.118[54149] (312 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 10[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (3356 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 psdeprodswan01 charon: 10[ENC] parsed IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR DNS NBNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(MULT_AUTH) N(EAP_ONLY) ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] received cert request for unknown ca with keyid <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>. (several unknown certificates here)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] received cert request for unknown ca with keyid a5:c5:f2:eb:2d:7a:72:5e:a3:ab:37:c5:8a:5a:4f:c7:31:7d:3a:1d<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] received 152 cert requests for an unknown ca<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[CFG] looking for peer configs matching 10.10.39.2[%any]...2.240.209.118[DOMAIN\user]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[CFG] selected peer config 'win7rad'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] initiating EAP_IDENTITY method (id 0x00)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] processing INTERNAL_IP4_ADDRESS attribute<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] processing INTERNAL_IP4_DNS attribute<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] processing INTERNAL_IP4_NBNS attribute<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] peer supports MOBIKE<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] authentication of '[here DNS Name]' (myself) with RSA signature successful<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[IKE] sending end entity cert "C=[country], ST=[town], O=[organization], OU=[anon], CN=[here DNS Name]"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 10[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (1164 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (92 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[IKE] received EAP identity '[DOMAIN\username]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[CFG] sending RADIUS Access-Request to server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[CFG] received RADIUS Access-Challenge from server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[IKE] EAP_PEAP payload => 6 bytes @ 0x7f371801c970<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[IKE] 0: 01 01 00 06 19 20 ..... <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[IKE] initiating EAP_PEAP method (id 0x01)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[ENC] generating IKE_AUTH response 2 [ EAP/REQ/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 15[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (76 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (284 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[ENC] parsed IKE_AUTH request 3 [ EAP/RES/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[IKE] EAP_PEAP payload => 211 bytes @ 0x7f3718005cb0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[CFG] sending RADIUS Access-Request to server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[CFG] received RADIUS Access-Challenge from server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[IKE] EAP_PEAP payload => 1024 bytes @ 0x7f371802b6f0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[ENC] generating IKE_AUTH response 3 [ EAP/REQ/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 07[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (1100 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (76 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[ENC] parsed IKE_AUTH request 4 [ EAP/RES/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[IKE] EAP_PEAP payload => 6 bytes @ 0x2006cc0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[IKE] 0: 02 02 00 06 19 00 ......<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[CFG] sending RADIUS Access-Request to server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[CFG] received RADIUS Access-Challenge from server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[IKE] EAP_PEAP payload => 1020 bytes @ 0x20096a0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[ENC] generating IKE_AUTH response 4 [ EAP/REQ/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 16[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (1100 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (76 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[ENC] parsed IKE_AUTH request 5 [ EAP/RES/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[IKE] EAP_PEAP payload => 6 bytes @ 0x7f3718024290<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[IKE] 0: 02 03 00 06 19 00 ......<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[CFG] sending RADIUS Access-Request to server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[CFG] received RADIUS Access-Challenge from server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[IKE] EAP_PEAP payload => 747 bytes @ 0x7f37180088c0<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[ENC] generating IKE_AUTH response 5 [ EAP/REQ/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 05[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (812 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 11[NET] received packet: from 2.240.209.118[4500] to 10.10.39.2[4500] (92 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 11[ENC] parsed IKE_AUTH request 6 [ EAP/RES/PEAP ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 11[IKE] EAP_PEAP payload => 13 bytes @ 0x2009c70<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 11[IKE] 0: 02 04 00 0D 19 00 15 03 01 00 02 02 31 ............1<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:46 [here DNS Name Swan Server] charon: 11[CFG] sending RADIUS Access-Request to server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[CFG] received RADIUS Access-Reject from server '[here DNS Name RADIUS]'<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[IKE] RADIUS authentication of '[DOMAIN\username]' failed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[IKE] EAP method EAP_PEAP failed for peer [DOMAIN\username]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[ENC] generating IKE_AUTH response 6 [ EAP/FAIL ]<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[NET] sending packet: from 10.10.39.2[4500] to 2.240.209.118[4500] (76 bytes)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'>May 16 10:24:47 [here DNS Name Swan Server] charon: 11[IKE] IKE_SA win7rad[185] state change: CONNECTING => DESTROYING<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal align=center style='text-align:center'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif";color:#1F497D'><o:p> </o:p></span></p><div class=MsoNormal align=center style='text-align:center'><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><hr size=2 width="100%" align=center></span></div><p class=MsoNormal style='margin-bottom:12.0pt'><b>From: </b><a href="mailto:Martin.Shemon@parship.com">Martin Shemon</a><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br></span><b>Sent: </b>ý14/ý05/ý2014 18:13<span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br></span><b>To: </b><a href="mailto:users@lists.strongswan.org">users@lists.strongswan.org</a><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br></span><b>Subject: </b>[strongSwan] unable to connect via Ubuntu 12.04 / strongswan-nm / eap-radius<span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p></o:p></span></p><div><div><p class=MsoNormal>Hi all,<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal><span lang=EN-US>after testing the whole day around there is still no working solution for me.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>What we have here:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>1 Strongswan Server with IKEv2</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>1 FreeRadius Server</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>1 DHCP Server</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>1 Active Directory Server which is behind the RADIUS Server</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Authentication via eap-radius and one type of connection which is working for the most clients.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Goal is to connect and authenticate all clients with the same connectionconfiguration</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Working Clients:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Windows 7 x64</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Android</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>MacOS X 10.9</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Not working Clients:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Ubuntu 10.04 / 12.04</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>One question: has anybody such a configuration running ? Problem is that the Ubuntu Clients (with strongswan-nm plugin) do not cconnect cause the phase 2 (EAP-radius) is not working like the windows connection. For me it looks like the eap-tls tunnel is not coming up cause of a not accepted certificate. The certificates work fine on all the other clients.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>ipsec.conf:</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US># ipsec.conf - strongSwan IPsec configuration file</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>config setup</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>conn %default</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> keyexchange=ikev2</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> ike=aes256-sha1-modp1024!</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> esp=aes256-sha1!</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> dpdaction=clear</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> dpddelay=300s</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> rekey=no</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> left=%any</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> leftsubnet=0.0.0.0/0</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> leftauth=pubkey</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> leftcert=[hiddenCauseOfPrivacy].pem</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> leftid= [hiddenCauseOfPrivacy].net </span><span lang=EN-US style='font-family:Wingdings'>à</span><span lang=EN-US> DNS Name</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> leftfirewall=yes</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>conn win7rad</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> right=%any</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> rightsourceip=%dhcp</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> rightauth=eap-radius</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> eap_identity=%identity</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> rightsendcert=never</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> auto=add</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>What can we do to analyze this problem in deep.</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US> </span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Regards</span><o:p></o:p></p><p class=MsoNormal><span lang=EN-US>Martin Shemon</span><o:p></o:p></p></div></div></div></body></html>