<div dir="ltr"><div>Hi, I am trying to run EAP-TLS client authentication with diameter server. Strongswan is failing EAP-TLS method.Strongswan log:initiating IKE_SA init_nai_v4_v4_tls[1] to 122.122.122.120 generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (708 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (38 bytes) parsed IKE_SA_INIT response 0 [ N(INVAL_KE) ] peer didn't accept DH group MODP_2048, it requested MODP_1024 initiating IKE_SA init_nai_v4_v4_tls[1] to 122.122.122.120 generating IKE_SA_INIT request 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (580 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (349 bytes) parsed IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) CERTREQ ] received cert request for "C=IN, ST=HARYANA, L=GURGAON, O=ARICENT, OU=ARI_CA, CN=CA" received cert request for "CN=quarry0, O=Quarry1, L=Gurgaon, C=IN" sending cert request for "C=IN, ST=HARYANA, L=GURGAON, O=ARICENT, OU=ARI_CA, CN=CA" sending cert request for "CN=quarry0, O=Quarry1, L=Gurgaon, C=IN" sending cert request for "C=IN, ST=Haryana, L=Delhi/NCR, O=Aricent, OU=Datacom, CN=Gagandeep, E=<a href="mailto:Gagan.Taneja@aricent.com">Gagan.Taneja@aricent.com</a>" sending end entity cert "C=IN, ST=HARYANA, O=ARICENT, OU=ARI_FAP, CN=<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>" establishing CHILD_SA init_nai_v4_v4_tls generating IKE_AUTH request 1 [ IDi CERT CERTREQ IDr CP(ADDR DNS) SA TSi TSr N(EAP_ONLY) ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (1564 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (892 bytes) parsed IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/TLS ] received end entity cert "CN=quarry0, C=IN, O=Quarry3"   using certificate "CN=quarry0, C=IN, O=Quarry3"   using trusted ca certificate "CN=quarry0, O=Quarry1, L=Gurgaon, C=IN" checking certificate status of "CN=quarry0, C=IN, O=Quarry3" certificate status is not available   reached self-signed root ca with a path length of 0 authentication of 'rohit' with RSA signature successful server requested EAP_TLS authentication (id 0x02) sending end entity cert "C=IN, ST=HARYANA, O=ARICENT, OU=ARI_FAP, CN=<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>" generating IKE_AUTH request 2 [ CERT EAP/RES/TLS ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (1292 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (1100 bytes) parsed IKE_AUTH response 2 [ EAP/REQ/TLS ] negotiated TLS 1.2 using suite TLS_RSA_WITH_AES_128_CBC_SHA sending end entity cert "C=IN, ST=HARYANA, O=ARICENT, OU=ARI_FAP, CN=<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>" generating IKE_AUTH request 3 [ CERT EAP/RES/TLS ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (1180 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (316 bytes) parsed IKE_AUTH response 3 [ EAP/REQ/TLS ] received TLS server certificate 'C=IN, ST=HARYANA, O=ARICENT, OU=ARICENT_AAA, CN=<a href="http://aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org">aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org</a>' received TLS cert request for 'C=IN, ST=HARYANA, L=GURGAON, O=ARICENT, OU=ARI_CA, CN=CA no TLS peer certificate found for '<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>', skipping client authentication   using certificate "C=IN, ST=HARYANA, O=ARICENT, OU=ARICENT_AAA, CN=<a href="http://aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org">aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org</a>"   using trusted ca certificate "C=IN, ST=HARYANA, L=GURGAON, O=ARICENT, OU=ARI_CA, CN=CA" checking certificate status of "C=IN, ST=HARYANA, O=ARICENT, OU=ARICENT_AAA, CN=<a href="http://aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org">aaa1.nai.epc.mnc213.mcc090.3gppnetwork.org</a>" certificate status is not available   reached self-signed root ca with a path length of 0 sending end entity cert "C=IN, ST=HARYANA, O=ARICENT, OU=ARI_FAP, CN=<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>" generating IKE_AUTH request 4 [ CERT EAP/RES/TLS ] sending packet: from 157.121.121.190[500] to 122.122.122.120[500] (1532 bytes) received packet: from 122.122.122.120[500] to 157.121.121.190[500] (76 bytes) parsed IKE_AUTH response 4 [ EAP/REQ/TLS ] EAP_TLS method failed ipsec.confconn init_nai_v4_v4_tls      leftid=<a href="mailto:223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org">223456789123456@nai.epc.mnc213.mcc090.3gppnetwork.org</a>      leftauth=eap      left=157.121.121.190      leftsourceip=10.10.10.1      #ike=3des-sha1-modp1024!      #esp = aes-md5-modp1024!      leftcert=fap-tls-10.crt      leftfirewall=yes      right=122.122.122.120      rightsubnet=<a href="http://151.151.151.0/24">151.151.151.0/24</a>      rightid=rohit      rightauth=pubkey      auto=add Kindly let me know if there is any configuration issue or any other issue.

</p><p> </p>

<p class="MsoNormal">Regards,</p>Akash</div></div>