<div dir="ltr"><div><div>Hi Andreas,<br><br></div>That was my problem. Thanks for the tip. I was beginning to lose hope. :P<br><br></div>-Justin<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Sep 27, 2014 at 1:42 PM, Andreas Steffen <span dir="ltr"><<a href="mailto:andreas.steffen@strongswan.org" target="_blank">andreas.steffen@strongswan.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi,<br>
<br>
you must enable and load the eap-identity plugin on the client side.<br>
And if the EAP identity does not equal the IKEv2 identity you must<br>
define the EAP Identity with<br>
<br>
eap_identity=....<br>
<br>
in ipsec.conf in the client configuration.<br>
<br>
Regards<br>
<br>
Andreas<br>
<span class=""><br>
On 09/26/2014 07:38 PM, Justin Michael Schwartzbeck wrote:<br>
> Hello,<br>
><br>
> I am trying to set up strongswan as a client to connect to a vpn server<br>
> using EAP-TLS authentication. I have my connection set up as follows:<br>
><br>
</span><span class="">> /conn client<br>
> keyexchange=ikev2<br>
> right=<a href="http://myvpnserver.domain.com" target="_blank">myvpnserver.domain.com</a> <<a href="http://myvpnserver.domain.com" target="_blank">http://myvpnserver.domain.com</a>><br>
</span>> rightid=%<a href="http://myvpnserver.domain.com" target="_blank">myvpnserver.domain.com</a> <<a href="http://myvpnserver.domain.com" target="_blank">http://myvpnserver.domain.com</a>><br>
> rightsubnet=<a href="http://0.0.0.0/0" target="_blank">0.0.0.0/0</a> <<a href="http://0.0.0.0/0" target="_blank">http://0.0.0.0/0</a>><br>
<span class="">> leftsourceip=%config<br>
> leftauth=eap<br>
> left=<a href="http://myclient.domain.com" target="_blank">myclient.domain.com</a> <<a href="http://myclient.domain.com" target="_blank">http://myclient.domain.com</a>><br>
</span>> leftid=username<br>
> leftcert=server.crt.pem<br>
> auto=add/<br>
<span class="">><br>
> When I enter "ipsec up client" I get a failure on the client side:<br>
><br>
</span>> /initiating IKE_SA client[1] to <vpn_server_ip><br>
<span class="">> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> sending packet: from <client_ip>[500] to <vpn_server_ip>[500] (708 bytes)<br>
> received packet: from <vpn_server_ip>[500] to <client_ip>[500] (38 bytes)<br>
> parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ]<br>
> peer didn't accept DH group MODP_2048, it requested MODP_1024<br>
> initiating IKE_SA client[1] to <vpn_server_ip><br>
> generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ]<br>
> sending packet: from <client_ip>[500] to <vpn_server_ip>[500] (580 bytes)<br>
> received packet: from <vpn_server_ip>[500] to <client_ip>[500] (381 bytes)<br>
> parsed IKE_SA_INIT response 0 [ SA KE No V V N(NATD_S_IP) N(NATD_D_IP)<br>
> CERTREQ ]<br>
> received cert request for "CN=rootCA, CN=Common Name, O=Company Name,<br>
> OU=Organization, C=Country, ST=State, L=City, E=<a href="mailto:admin@domain.com">admin@domain.com</a><br>
</span>> <mailto:<a href="mailto:admin@domain.com">admin@domain.com</a>>"<br>
<span class="">> received 1 cert requests for an unknown ca<br>
> sending cert request for "CN=rootCA, CN=Common Name, O=Common Name,<br>
> OU=Organization, C=Country, ST=State, L=City, E=<a href="mailto:admin@domain.com">admin@domain.com</a><br>
</span>> <mailto:<a href="mailto:admin@domain.com">admin@domain.com</a>>"<br>
<span class="">> establishing CHILD_SA client<br>
> generating IKE_AUTH request 1 [ IDi N(INIT_CONTACT) CERTREQ CPRQ(ADDR<br>
> DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) ]<br>
> sending packet: from <client_ip>[4500] to <vpn_server_ip>[4500] (380 bytes)<br>
> received packet: from <vpn_server_ip>[4500] to <client_ip>[4500] (1420<br>
> bytes)<br>
> parsed IKE_AUTH response 1 [ V IDr CERT AUTH EAP/REQ/ID ]<br>
> received end entity cert "CN=<a href="http://myvpnserver.domain.com" target="_blank">myvpnserver.domain.com</a><br>
</span>> <<a href="http://myvpnserver.domain.com" target="_blank">http://myvpnserver.domain.com</a>>, C=Country, ST=State, O=Company,<br>
> OU=Organization"<br>
> using certificate "CN=<a href="http://myvpnserver.domain.com" target="_blank">myvpnserver.domain.com</a><br>
> <<a href="http://myvpnserver.domain.com" target="_blank">http://myvpnserver.domain.com</a>>, C=Country, ST=State, O=Company,<br>
<span class="">> OU=Organization"<br>
> using trusted ca certificate "CN=rootCA, CN=Common Name, O=Company<br>
> Name, OU=Organization, C=Country, ST=State, L=City, E=<a href="mailto:admin@domain.com">admin@domain.com</a><br>
</span><span class="">> <mailto:<a href="mailto:admin@domain.com">admin@domain.com</a>>"<br>
> checking certificate status of "CN=<a href="http://myvpnserver.domain.com" target="_blank">myvpnserver.domain.com</a><br>
</span>> <<a href="http://myvpnserver.domain.com" target="_blank">http://myvpnserver.domain.com</a>>, C=Country, ST=State, O=Company,<br>
<span class="">> OU=Organization"<br>
> certificate status is not available<br>
> reached self-signed root ca with a path length of 0<br>
> authentication of '<vpn_server_ip>' with RSA signature successful<br>
> server requested EAP_IDENTITY (id 0x3B), sending 'username'<br>
> EAP_IDENTITY not supported, sending EAP_NAK<br>
> generating IKE_AUTH request 2 [ EAP/RES/NAK ]<br>
> sending packet: from <client_ip>[4500] to <vpn_server_ip>[4500] (76 bytes)<br>
> received packet: from <vpn_server_ip>[4500] to <client_ip>[4500] (76 bytes)<br>
> parsed IKE_AUTH response 2 [ N(AUTH_FAILED) ]<br>
> received AUTHENTICATION_FAILED notify error<br>
</span>> establishing connection 'client' failed/<br>
<span class="">><br>
> On the server side, I am using remote authentication with RADIUS. The<br>
> EAP request seems to be incomplete, or fails somehow:<br>
><br>
</span>> /rad_recv: Access-Request packet from host 10.89.150.210 port 1645,<br>
<div><div class="h5">> id=131, length=135<br>
> Service-Type = Login-User<br>
> Cisco-AVPair = "service-type=Login"<br>
> Calling-Station-Id = "L2L40A5996D2ZO2L40A5996E3ZH11941194ZN1D"<br>
> User-Name = "username"<br>
> EAP-Message = 0x023b0006030d<br>
> Message-Authenticator = 0xf62fa0a5eaba2ea387bd90c3cfe46c7f<br>
> NAS-IP-Address = <vpn_server_ip><br>
> # Executing section authorize from file /etc/raddb/sites-enabled/default<br>
> +- entering group authorize {...}<br>
> ++[preprocess] returns ok<br>
> ++[chap] returns noop<br>
> ++[mschap] returns noop<br>
> ++[digest] returns noop<br>
> [suffix] No '@' in User-Name = "username", looking up realm NULL<br>
> [suffix] No such realm "NULL"<br>
> ++[suffix] returns noop<br>
> [eap] EAP packet type response id 59 length 6<br>
> [eap] No EAP Start, assuming it's an on-going EAP conversation<br>
> ++[eap] returns updated<br>
> [files] users: Matched entry DEFAULT at line 50<br>
> ++[files] returns ok<br>
> ++[expiration] returns noop<br>
> ++[logintime] returns noop<br>
> [pap] WARNING: Auth-Type already set. Not setting to PAP<br>
> ++[pap] returns noop<br>
> Found Auth-Type = EAP<br>
> # Executing group from file /etc/raddb/sites-enabled/default<br>
> +- entering group authenticate {...}<br>
> [eap] Either EAP-request timed out OR EAP-response to an unknown EAP-request<br>
> [eap] Failed in handler<br>
> ++[eap] returns invalid<br>
> Failed to authenticate the user.<br>
> Using Post-Auth-Type Reject<br>
> # Executing group from file /etc/raddb/sites-enabled/default<br>
> +- entering group REJECT {...}<br>
> [attr_filter.access_reject] expand: %{User-Name} -> username<br>
> attr_filter: Matched entry DEFAULT at line 11<br>
> ++[attr_filter.access_reject] returns updated<br>
> Delaying reject of request 129 for 1 seconds<br>
> Going to the next request<br>
> Waking up in 0.9 seconds.<br>
> Sending delayed reject for request 129<br>
> Sending Access-Reject of id 131 to 10.89.150.210 port 1645<br>
> Waking up in 4.9 seconds.<br>
> Cleaning up request 129 ID 131 with timestamp +64810<br>
> Ready to process requests.<br>
><br>
> /<br>
> So here is my impression of what's happening, and correct me if I'm<br>
> wrong: I think that on the strongswan side, EAP authentication is being<br>
> used but there is no TLS happening. It seems like RADIUS is trying to<br>
> determine whether the client is using TLS, MD5, etc. but fails to<br>
> determine this. From the strongswan documentation I have gotten the idea<br>
> that the client does not initiate EAP-TLS but it is enforced on the<br>
> server side. Is there a way to do what I am trying to do?<br>
><br>
> Thanks in advance.<br>
</div></div>======================================================================<br>
Andreas Steffen <a href="mailto:andreas.steffen@strongswan.org">andreas.steffen@strongswan.org</a><br>
strongSwan - the Open Source VPN Solution! <a href="http://www.strongswan.org" target="_blank">www.strongswan.org</a><br>
Institute for Internet Technologies and Applications<br>
University of Applied Sciences Rapperswil<br>
CH-8640 Rapperswil (Switzerland)<br>
===========================================================[ITA-HSR]==<br>
<br>
</blockquote></div><br></div>