<div dir="ltr">thanks Noel,<div><br></div><div>I've made those changes and restarted ipsec, but I'm still getting the same error in my server log:</div><div><br></div><div>"peer requested EAP, config inacceptable"<br></div><div>"no alternative config found"</div><div><br></div><div>This is my updated ipsec: <a href="http://pastebin.com/TnZaiZX8">http://pastebin.com/TnZaiZX8</a></div><div><br></div><div>Does that look correct?</div><div><br></div><div>appreciate the help,</div><div>imran</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Sat, Nov 29, 2014 at 5:47 PM, Noel Kuntze <span dir="ltr"><<a href="mailto:noel@familie-kuntze.de" target="_blank">noel@familie-kuntze.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class=""><br>
-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA256<br>
<br>
</span>Hello Imram,<br>
<br>
If you want to use psk-mschapv2, you need to specify<br>
leftauth=psk<br>
rightauth=psk<br>
rightauth2=eap-mschap<br>
<br>
Please make sure this is in your configuration.<br>
<span class=""><br>
Mit freundlichen Grüßen/Regards,<br>
Noel Kuntze<br>
<br>
GPG Key ID: 0x63EC6658<br>
Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
<br>
</span>Am 30.11.2014 um 02:09 schrieb Imran Akbar:<br>
<span class="">> thanks for pointing me in the right direction Noel.<br>
><br>
> I've installed strongswan-plugin-eap-mschapv2, added rightauth=eap-mschapv2 to my ipsec.conf file, and restart ipsec.<br>
> I now see the following when I try to connect:<br>
><br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] looking for peer configs matching 172.31.25.2[%any]...76.126.165.62[app]<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] selected peer config 'vpn'<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] using configured EAP-Identity app<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] initiating EAP_MSCHAPV2 method (id 0xBE)<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] received ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] peer supports MOBIKE<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[CFG] no IDr configured, fall back on IP address<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[IKE] no private key found for '172.31.25.2'<br>
> Nov 30 00:29:27 ip-172-31-25-2 charon: 01[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]<br>
><br>
> It seems like I need to tell it to use the username/password, instead of looking for a key... or is a certificate mandatory for all EAP configurations, even using a username/password?<br>
><br>
> regards,<br>
> imran<br>
><br>
</span><span class="">> On Sat, Nov 29, 2014 at 4:03 PM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a>>> wrote:<br>
><br>
><br>
> Hello Imran,<br>
><br>
> You need to specify rightauth2=eap-mschapv2, so strongSwan is configured correctly to accept<br>
> eap authentication using mschapv2 in round 2.<br>
><br>
> You also lack the eap-mschapv2 modules, that you need for eap-mschapv2.<br>
> Install it via your package manager or, if you built strongSwan yourself, configure the strongSwan sources with --enable-eap-mschapv2,<br>
> "make uninstall" "make clean" "make" and "make install".<br>
><br>
> Also, please make sure you send your answer to all parties involved, not just me.<br>
><br>
> Mit freundlichen Grüßen/Regards,<br>
> Noel Kuntze<br>
><br>
> GPG Key ID: 0x63EC6658<br>
> Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> Am 30.11.2014 um 00:54 schrieb Imran Akbar:<br>
> > Hey Noel and Thomas,<br>
><br>
> > thanks for your help.<br>
> > I've made some progress - I'm now getting an "AUTH FAILED" error from my client.<br>
> > I'm trying to connect via the StrongSwan client on Android using IKEv2 EAP (username/password).<br>
><br>
> > Here is my ipsec.conf: <a href="http://pastebin.com/Ap5gUX0f" target="_blank">http://pastebin.com/Ap5gUX0f</a><br>
><br>
> > Here is my secrets.conf: <a href="http://pastebin.com/hhX9micY" target="_blank">http://pastebin.com/hhX9micY</a><br>
><br>
> > Here is my server log: <a href="http://pastebin.com/W99PPKt3" target="_blank">http://pastebin.com/W99PPKt3</a> (looks like the key issue is "peer requested EAP, config inacceptable")<br>
><br>
> > Here is my client log: <a href="http://pastebin.com/2w9NS1Zs" target="_blank">http://pastebin.com/2w9NS1Zs</a><br>
><br>
> > I'm going to keep tweaking the authentication configs to see if I can make it work.<br>
><br>
> > yours,<br>
> > imran<br>
><br>
><br>
</span><div><div class="h5">> > On Sat, Nov 29, 2014 at 9:04 AM, Noel Kuntze <<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a>> <mailto:<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a> <mailto:<a href="mailto:noel@familie-kuntze.de">noel@familie-kuntze.de</a>>>> wrote:<br>
><br>
><br>
> > Hello Imran,<br>
><br>
> > IPsec/L2TP is mostly used with IKEv1, not IKEv2. Please tell us what clients you're trying to use,<br>
> > to make sure they try to use IKEv2, too.<br>
><br>
> > L2TP is not handled by strongSwan. You need to use xl2tp for that. Most clients try to use transport mode<br>
> > for the IPsec connection. Make sure your peer configuration has that specified. Also, plese make strongSwan<br>
> > write a log [1] with the settings shown in [2], show us the log that was created and show us your ipsec.conf.<br>
><br>
> > [1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/LoggerConfiguration</a><br>
><br>
> > [2]<br>
> > default = 3<br>
> > mgr = 1<br>
> > ike = 1<br>
> > net = 1<br>
> > enc = 0<br>
> > cfg = 2<br>
> > asn = 1<br>
> > job = 1<br>
> > knl = 1<br>
> > append=no<br>
> > ike_name=no<br>
> > flush_line=yes<br>
><br>
><br>
> > Mit freundlichen Grüßen/Regards,<br>
> > Noel Kuntze<br>
><br>
> > GPG Key ID: 0x63EC6658<br>
> > Fingerprint: 23CA BB60 2146 05E7 7278 6592 3839 298F 63EC 6658<br>
><br>
> > Am 29.11.2014 um 17:53 schrieb Imran Akbar:<br>
> > > Hi everyone,<br>
> > > thanks for such a well-developed and maintained library.<br>
><br>
> > > I'm trying to setup Ipsec/L2TP on my Ubuntu 14 server with IKEv2 and a PSK.<br>
><br>
> > > I've read through a bunch of tutorials online:<br>
> > > <a href="http://trick77.com/2014/05/04/strongswan-5-vpn-ubuntu-14-04-lts-psk-xauth/" target="_blank">http://trick77.com/2014/05/04/strongswan-5-vpn-ubuntu-14-04-lts-psk-xauth/</a><br>
> > > <a href="http://www.foteviken.de/?p=2175" target="_blank">http://www.foteviken.de/?p=2175</a><br>
> > > <a href="http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html" target="_blank">http://endlessroad1991.blogspot.com/2014/04/setup-ipsec-vpn-on-ec2.html</a><br>
><br>
> > > and I've opened up UDP ports 500 & 4500, but I still have clients complaining about gateway timeouts and not being able to connect to the VPN.<br>
><br>
> > > Is there some sort of a configuration script that can walk you through all the necessary steps to get this working, or a gist that someone could share of their config?<br>
> > > I don't see anything in my /var/log/auth.conf that's indicative of VPN traffic.<br>
><br>
> > > yours,<br>
> > > imran<br>
><br>
><br>
> > > _______________________________________________<br>
> > > Users mailing list<br>
</div></div>> > > <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>>><br>
<span class="">> > > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
> > _______________________________________________<br>
> > Users mailing list<br>
</span>> > <a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a> <mailto:<a href="mailto:Users@lists.strongswan.org">Users@lists.strongswan.org</a>>><br>
<span class="">> > <a href="https://lists.strongswan.org/mailman/listinfo/users" target="_blank">https://lists.strongswan.org/mailman/listinfo/users</a><br>
><br>
><br>
><br>
><br>
><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v2<br>
<br>
</span>iQIcBAEBCAAGBQJUendAAAoJEDg5KY9j7GZY10wP/1F9oeKFBO1eubZJAkGpFK28<br>
FfCx1YcMbYRM4TvXR52IfKm2cFXZcSJXNQCH/bLMWvVvGWX+jx4BZxZjODHj5K/w<br>
2iPL2rYUqVhnB3YT7B2iXjmkFSC0af6WX+toD4zXPS7Lp3+zWeGxeDqSTvSpWztM<br>
bsTF81/NH7N/JVFBfZOY+iPiWUuafY//aZq+XWAsoz8E33o8BeUv0Xgz/KKHbTkv<br>
MHo2HKJscQ65+98/s94vmLG7fgR5+rYweN1KScodnFQm6MyWTN7vm23kBV/kAYk7<br>
X5j61tCmiY7ADGlVg5XYzzTLG5M43OlcnSQoFWHtB8iwc2OMHameATCbUtiPB5ep<br>
8msbziesCDNHL9DDbjF9laVEmpYJIONQkGVbtQSP4z2Bf5PBNIpb3x4k/33L8asR<br>
pDkk9Ul7sGz6kBUMjM44G3qABKTQA9gcwcR8pzSC4Q/FZ1SX8pT56K4ncUW99UQa<br>
QEax2Ct7dv+dmepivKHINCbtCgKobjrScTbT0rQnMIhD2VDzx1CdX6jCo6BaZKdF<br>
DW51NXWGdDmqrjXClF6Dk761RUtYjHZ1p4f8lW9j3LicxgEtu/AEAw0UhHJlmBvO<br>
a1P1AdJx6i1GdPMnzBJ9axi2H1zAy7EI8ggWhO4F6WMeL7prvNptc+1W2dutvhjK<br>
Iiamq2eZE/8T2UBgVPHm<br>
=yTxn<br>
-----END PGP SIGNATURE-----<br>
<br>
</blockquote></div><br></div>