<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri" size="2"><span style="font-size:11pt;">
<div>Hello all,</div>
<div> </div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">I am trying to set a VPN between Strongswan (5.3.3) on Linux and a Fortigate 60D (FortiOS 5.2.4), in IKEv2 EAP identity.</span></font></div>
<div> </div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">The Fortigate sends the EAP_IDENTITY and Strongswan answers with EAP_IDENTITY.</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">When eap_identity is 172.26.185.1 the message EAP_IDENTITY length is 96 bytes (see Strongswan traces)</span></font></div>
<div> </div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[NET] received packet: from 172.26.185.50[4500] to 172.26.185.82[4500] (192 bytes)</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[ENC] parsed IKE_AUTH response 1 [ IDr AUTH EAP/REQ/ID ]</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[IKE] authentication of '172.26.185.50' with pre-shared key successful </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[IKE] server requested EAP_IDENTITY (id 0x2A), sending '172.26.185.1' </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[IKE] reinitiating already active tasks </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[IKE] IKE_AUTH task </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ] </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[NET] sending packet: from 172.26.185.82[4500] to 172.26.185.50[4500] (96 bytes)</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 04[NET] sending packet: from 172.26.185.82[4500] to 172.26.185.50[4500] </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[MGR] checkin IKE_SA vpn_FGT[1] </span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:04 (none) charon: 09[MGR] check-in of IKE_SA successful.</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;">Sep 22 16:32:07 (none) charon: 10[MGR] checkout IKE_SA </span></font></div>
<div> </div>
<div>But when received by Fortigate, the identity is wrong (fortigate traces): </div>
<div> </div>
<div>2015-09-22 16:08:08 ike 0: comes 172.26.185.82:4500->10.0.0.2:4500,ifindex=5....</div>
<div>2015-09-22 16:08:08 ike 0: IKEv2 exchange=AUTH id=90a5f8b92f8ab9da/b2d3b9839ad56895:00000002 len=96</div>
<div>2015-09-22 16:08:08 ike 0: in 90A5F8B92F8AB9DAB2D3B9839AD568952E202308000000020000006030000044C6A08A5B75AFA1D9070798469318CE7F054CB250AF1A3D3D39F7AB5BB89405435CB93F27DEE89EFF7ABA2F7CD9A5D8AF4312B2D6697B7EB34DD9BADD4B62BDCD</div>
<div>2015-09-22 16:08:08 ike 0:poc:42: dec 90A5F8B92F8AB9DAB2D3B9839AD568952E202308000000020000002D300000040000000D022A000901AC1AB901</div>
<div>2015-09-22 16:08:08 ike 0:poc:42: responder received EAP msg</div>
<div>2015-09-22 16:08:08 ike 0:poc:42: send EAP message to FNBAM</div>
<div>2015-09-22 16:08:08 ike 0:poc:42: initiating EAP authentication</div>
<div>2015-09-22 16:08:08 ike 0:poc: EAP user "<font face="Tahoma">�</font><font face="Tahoma">�</font>"</div>
<div> </div>
<div>When I change <font face="Courier New" size="2"><span style="font-size:10pt;">eap_identity </span></font><font face="Courier New" size="2"><span style="font-size:10pt;">to 172.26.185.A, the </span></font><font face="Courier New" size="2"><span style="font-size:10pt;">message
</span></font><font face="Courier New" size="2"><span style="font-size:10pt;">EAP_IDENTITY</span></font><font face="Courier New" size="2"><span style="font-size:10pt;"> </span></font><font face="Courier New" size="2"><span style="font-size:10pt;">length</span></font><font face="Courier New" size="2"><span style="font-size:10pt;">,
send by Stronswan,</span></font><font face="Courier New" size="2"><span style="font-size:10pt;"> is </span></font><font face="Courier New" size="2"><span style="font-size:10pt;">112 </span></font><font face="Courier New" size="2"><span style="font-size:10pt;">bytes</span></font><font face="Courier New" size="2"><span style="font-size:10pt;">:</span></font></div>
<div><font face="Courier New" size="2"><span style="font-size:10pt;"> </span></font></div>
<div>Sep 22 16:24:02 (none) charon: 10[NET] received packet: from 172.26.185.50[4500] to 172.26.185.82[4500] (192 bytes) </div>
<div>Sep 22 16:24:02 (none) charon: 10[ENC] parsed IKE_AUTH response 1 [ IDr AUTH EAP/REQ/ID ] </div>
<div>Sep 22 16:24:02 (none) charon: 10[IKE] authentication of '172.26.185.50' with pre-shared key successful </div>
<div>Sep 22 16:24:02 (none) charon: 10[IKE] server requested EAP_IDENTITY (id 0x28), sending '172.26.185.A' </div>
<div>Sep 22 16:24:02 (none) charon: 10[IKE] reinitiating already active tasks </div>
<div>Sep 22 16:24:02 (none) charon: 10[IKE] IKE_AUTH task </div>
<div>Sep 22 16:24:02 (none) charon: 10[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ] </div>
<div>Sep 22 16:24:02 (none) charon: 10[NET] sending packet: from 172.26.185.82[4500] to 172.26.185.50[4500] (112 bytes) </div>
<div>Sep 22 16:24:02 (none) charon: 04[NET] sending packet: from 172.26.185.82[4500] to 172.26.185.50[4500] </div>
<div>Sep 22 16:24:02 (none) charon: 10[MGR] checkin IKE_SA vpn_FGT[1] </div>
<div>Sep 22 16:24:02 (none) charon: 10[MGR] check-in of IKE_SA successful. </div>
<div>Sep 22 16:24:05 (none) charon: 11[MGR] checkout IKE_SA </div>
<div> </div>
<div>And, on Fortigate, the eap_identity is get well :</div>
<div> </div>
<div>2015-09-22 16:00:06 ike 0: comes 172.26.185.82:4500->10.0.0.2:4500,ifindex=5....</div>
<div>2015-09-22 16:00:06 ike 0: IKEv2 exchange=AUTH id=c583379a3f946357/953d7d30d37f1773:00000002 len=112</div>
<div>2015-09-22 16:00:06 ike 0: in C583379A3F946357953D7D30D37F17732E202308000000020000007030000054277F6F2974A652A7182F04E79E22EE87BC29BB3E168D409273D8396A5B1B33B5107CF299BFDF3DBBC8DEBD856D277C299A98770F6B7518AFFE87595F7EE892AD79960DB96CB20EB263E4508CE7DF11B9</div>
<div>2015-09-22 16:00:06 ike 0:poc:40: dec C583379A3F946357953D7D30D37F17732E2023080000000200000035300000040000001502280011013137322E32362E3138352E41</div>
<div> ############ my comment: In ascii 1 7 2 . 2 6 . 1 8 5 . A</div>
<div>2015-09-22 16:00:06 ike 0:poc:40: responder received EAP msg</div>
<div>2015-09-22 16:00:06 ike 0:poc:40: send EAP message to FNBAM</div>
<div>2015-09-22 16:00:06 ike 0:poc:40: initiating EAP authentication</div>
<div>2015-09-22 16:00:06 ike 0:poc: EAP user "172.26.185.A"</div>
<div> </div>
<div>Why this length difference when only one char is modified ? Is it normal ?</div>
<div>Is the message sent well when eap_identity is set to “172.26.185.1”?</div>
<div> </div>
<div>For info, when I set eap_identity to 172.26.185.82 (client IP address), the message sent seems also wrong, with also a size of 96 bytes.</div>
<div> </div>
<div>For info (2), the ipsec.conf file used is:</div>
<div> </div>
<div># ipsec.conf - strongSwan IPsec configuration file</div>
<div># basic configuration</div>
<div>config setup</div>
<div> # strictcrlpolicy=yes</div>
<div> # uniqueids = no</div>
<div> charondebug="cfg 2, chd 2, dmn 2, esp 2, ike 2, knl 2, mgr 2, net 3"</div>
<div># Add connections here.</div>
<div>conn %default</div>
<div> keyexchange=ikev2</div>
<div># Sample VPN connections</div>
<div>conn vpn_FGT</div>
<div> left=172.26.185.82</div>
<div> leftsourceip=%config</div>
<div> leftauth=eap</div>
<div> leftfirewall=yes</div>
<div> leftid=172.26.185.82</div>
<div> eap_identity=172.26.185.1</div>
<div> auto=start</div>
<div> ike=aes256-sha256-modp2048</div>
<div> esp=aes256-sha256-modp2048</div>
<div> right=172.26.185.50</div>
<div> rightsubnet=172.26.185.50/32</div>
<div> rightid=%any</div>
<div> rightauth=psk</div>
<div> </div>
<div>Thanks and regards</div>
<div> </div>
<div>Denis</div>
<div> </div>
</span></font>
</body>
</html>