<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hello all,</div>
<div> </div>
<div>I am trying to set a VPN between Strongswan on Linux and a Fortigate 60C (FortiOS 5.2.4), in IKEv2 EAP identity.</div>
<div>The Fortigate sends the EAP_IDENTITY and Strongswan answers with EAP_IDENTITY, and Fortigate does not answer any more (see traces below).</div>
<div> </div>
<div>Does anyone already use Fortigate 60C in IKEv2 EAP mode ?</div>
<div> </div>
<div>Thanks and regards</div>
<div> </div>
<div>Denis</div>
<div> </div>
<div># ipsec.conf - strongSwan IPsec configuration file</div>
<div> </div>
<div>config setup</div>
<div> charondebug="cfg 2, chd 2, dmn 2, esp 2, ike 2, knl 2, mgr 2"</div>
<div> </div>
<div># Add connections here.</div>
<div>conn %default</div>
<div> keyexchange=ikev2</div>
<div> </div>
<div># Sample VPN connections</div>
<div>conn vpn_FGT</div>
<div> left=X.X.X.82</div>
<div> leftsourceip=%config</div>
<div> leftauth=psk</div>
<div> leftfirewall=yes</div>
<div> leftid=172.26.185.82</div>
<div> auto=start</div>
<div> ike=aes256-sha256-modp2048</div>
<div> esp=aes256-sha256-modp2048</div>
<div> right=X.X.X.50</div>
<div> rightsubnet=X.X.X.50/32</div>
<div> rightid=%any</div>
<div> rightauth=eap</div>
<div> </div>
<div>Sep 15 14:59:11 (none) charon: 09[CFG] configured proposals: ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ, ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ</div>
<div>Sep 15 14:59:11 (none) charon: 09[KNL] got SPI c424fe4c</div>
<div>Sep 15 14:59:11 (none) charon: 09[ENC] generating IKE_AUTH request 1 [ IDi CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) ]</div>
<div>Sep 15 14:59:11 (none) charon: 09[NET] sending packet: from X.X.X.82[4500] to X.X.X.50[4500] (336 bytes)</div>
<div>Sep 15 14:59:11 (none) charon: 09[MGR] checkin IKE_SA vpn_FGT[1]</div>
<div>Sep 15 14:59:11 (none) charon: 10[MGR] checkout IKE_SA by message</div>
<div>Sep 15 14:59:11 (none) charon: 09[MGR] check-in of IKE_SA successful.</div>
<div>Sep 15 14:59:11 (none) charon: 10[MGR] IKE_SA vpn_FGT[1] successfully checked out</div>
<div>Sep 15 14:59:11 (none) charon: 10[NET] received packet: from X.X.X.50[4500] to X.X.X.82[4500] (192 bytes)</div>
<div>Sep 15 14:59:11 (none) charon: 10[ENC] parsed IKE_AUTH response 1 [ IDr AUTH EAP/REQ/ID ]</div>
<div>Sep 15 14:59:11 (none) charon: 10[IKE] authentication of 'X.X.X.50' with pre-shared key successful</div>
<div>Sep 15 14:59:11 (none) charon: 10[IKE] server requested EAP_IDENTITY (id 0x95), sending 'X.X.X.82'</div>
<div>Sep 15 14:59:11 (none) charon: 10[IKE] reinitiating already active tasks</div>
<div>Sep 15 14:59:11 (none) charon: 10[IKE] IKE_AUTH task</div>
<div>Sep 15 14:59:11 (none) charon: 10[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]</div>
<div>Sep 15 14:59:11 (none) charon: 10[NET] sending packet: from X.X.X.82[4500] to X.X.X.50[4500] (96 bytes)</div>
<div>Sep 15 14:59:11 (none) charon: 10[MGR] checkin IKE_SA vpn_FGT[1]</div>
<div>Sep 15 14:59:11 (none) charon: 10[MGR] check-in of IKE_SA successful.</div>
<div>Sep 15 14:59:13 (none) charon: 11[CFG] proposing traffic selectors for us:</div>
<div>Sep 15 14:59:13 (none) charon: 11[CFG] dynamic</div>
<div>Sep 15 14:59:13 (none) charon: 11[CFG] proposing traffic selectors for other:</div>
<div>Sep 15 14:59:13 (none) charon: 11[CFG] X.X.X.50/32</div>
<div>Sep 15 14:59:15 (none) charon: 06[MGR] checkout IKE_SA</div>
<div>Sep 15 14:59:15 (none) charon: 06[MGR] IKE_SA vpn_FGT[1] successfully checked out</div>
<div>Sep 15 14:59:15 (none) charon: 06[MGR] checkin IKE_SA vpn_FGT[1]</div>
<div>Sep 15 14:59:15 (none) charon: 06[MGR] check-in of IKE_SA successful.</div>
<div>Sep 15 14:59:15 (none) charon: 08[MGR] checkout IKE_SA</div>
<div>Sep 15 14:59:15 (none) charon: 08[MGR] IKE_SA vpn_FGT[1] successfully checked out</div>
<div>Sep 15 14:59:15 (none) charon: 08[MGR] checkin IKE_SA vpn_FGT[1]</div>
<div>Sep 15 14:59:15 (none) charon: 08[MGR] check-in of IKE_SA successful.</div>
<div>Sep 15 14:59:15 (none) charon: 13[MGR] checkout IKE_SA</div>
<div>Sep 15 14:59:15 (none) charon: 13[MGR] IKE_SA vpn_FGT[1] successfully checked out</div>
<div>Sep 15 14:59:15 (none) charon: 13[IKE] retransmit 1 of request with message ID 2</div>
<div>Sep 15 14:59:15 (none) charon: 13[NET] sending packet: from X.X.X.82[4500] to X.X.X.50[4500] (96 bytes)</div>
<div>Sep 15 14:59:15 (none) charon: 13[MGR] checkin IKE_SA vpn_FGT[1]</div>
<div> </div>
</span></font>
</body>
</html>