<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Arial" size="2"><span style="font-size:10pt;">
<div>Hi,</div>
<div> </div>
<div>After several days of not finding another path, I am trying to see what I have done wrong in terms of the eap-radius integration. It appears Strongswan is producing an Access-Request packet with the following attributes: User-name, NAS-Port-Type, Service-Type,
NAS-Port, NAS-Port-Id, NAS-IP-Address, Called-Station-ID, Calling-Station-Id, EAP-Message (last segment), NAS-Identifier, Message-Authenticator.</div>
<div> </div>
<div>One of the attributes for doing MS-CHAP-v2 is not in it. I thought that those might be vendor specific attributes 26:311 (I have experimented with the forwarding of attributes ike_to_radius = 26:311 but did not change anything).</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>I have configured the eap-radius servers in strongswan to point first to IAS 2003 and it fails, as it expects PEAP and cannot handle EAP-MS-Chap-v2. I have then pointed it to a Windows 2008 NPS server and it fails, with Access-Reject - looking at the packets
I don't see the MS-CHAP-v2 Challenge attribute coming through. [Short version: the password is not coming through in the Access-Request when eap-radius is involved]</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>The configuration is under IKEv2 type, I was able to bypass the radius stuff by simply doing a righauth=eap-mschapv2 using a local secrets file. I wanted to switch to radius based authentication and authorization. The client is windows 7 - I have tried
both EAP-MS-CHAPv2 and PEAP-MS-CHAPv2 with the eap-radius configuration and it did not work.</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>We are using strongswan-5.2.2 on centos6. I have looked at the examples and just cannot get the password to come through, only the attributes I initially listed.</div>
<div> </div>
<div>Thank you for your help.</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div>Steffen</div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Courier New" size="1"><span style="font-size:8pt;">_______________________________________________________________________________________________</span></font></div>
<div><font face="Courier New" size="1"><span style="font-size:8pt;">Steffen Plotner Amherst College Tel (413) 542-2348</span></font></div>
<div><font face="Courier New" size="1"><span style="font-size:8pt;">Systems/Network Administrator/Programmer PO BOX 5000 Fax (413) 542-2626</span></font></div>
<div><font face="Courier New" size="1"><span style="font-size:8pt;">Systems & Networking Amherst, MA 01002-5000 swplotner@amherst.edu</span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
<div><font face="Calibri" size="2"><span style="font-size:11pt;"> </span></font></div>
</span></font>
</body>
</html>