<div dir="ltr"><div><div><div><div><div><div>Hi,<br><br></div>I faced that there are no attr_sql support on standard Debian 9 packages.<br><br></div>ipsec statusall also prints all the available plugins, having already installed all the available strongswan debian packages.<br></div>So, on Debian 9 we cannot have more then this:<br><br>loaded plugins: <br>charon test-vectors ldap pkcs11 aesni aes rc2 sha2 sha1 md5 rdrand random nonce x509 revocation constraints pubkey pkcs1 pkcs7 pkcs8 pkcs12 pgp dnskey sshkey pem openssl gcrypt af-alg fips-prf gmp agent xcbc cmac hmac ctr ccm gcm curl attr kernel-netlink resolve socket-default connmark farp stroke vici updown eap-identity eap-aka eap-md5 eap-gtc eap-mschapv2 eap-radius eap-tls eap-ttls eap-tnc xauth-generic xauth-eap xauth-pam tnc-tnccs dhcp lookip error-notify certexpire led addrblock unity<br><br>This means, to me but every suggestion could be appreciated, that the only way to get a persistent pool lease system is to compile strongswan with --enable--attr-sql<br></div><br></div>Thank you, I'll bring more usefull informations after all this, such the setup notes<br></div>A huge setup migration is gonna to begin!<br><div><div><div><br></div></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">2017-10-16 22:08 GMT+02:00 Giuseppe De Marco <span dir="ltr"><<a href="mailto:giuseppe.demarco@unical.it" target="_blank">giuseppe.demarco@unical.it</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div><div><div><div><div><div><div>Hi all,<br><br></div>I'm using Debian GNU/Linux 9.2 (stretch) with standard strongswan package from stretch apt repository (5.5.1-4+deb9u1).<br><br></div><div>The tunnel is a ikev2 with eap-radius authentication.<br></div><div><br></div>I'm facing the problem that Windows 10 clients doesn't send their right identity.<br>Linux and Android clients works great instead, they always request the connections with the correct eap_identity as we expect to be.<br><br></div>The problem is that if the Windows client fails its identity it will take a dinamic virtual ip and not the static one, configured for it.<br><br></div>I also read about attr_sql and the possibility to fix the ip assignment in a second time, via sql.<br></div>I'd like also to play with it but, I installed all of the strongswan/charon packages, they are all here:<br><br>libstrongswan <wbr> <br>libstrongswan-extra-plugins<br>libstrongswan-standard-plugins<br>network-manager-strongswan<br>strongswan<br>strongswan-charon<br>strongswan-ike<br>strongswan-ikev1<br>strongswan-ikev2<br>strongswan-libcharon<br>strongswan-nm<br>strongswan-pki<br>strongswan-scepclient<br>strongswan-starter<br>strongswan-swanctl<br>charon-cmd <wbr> <br>charon-systemd<br>libcharon-extra-plugins<br>strongswan-charon<br>strongswan-libcharon<br><br></div>But I cannot see the attr_plugin loaded and running, with the command:<br><br></div>ipsec listplugins<br><br></div><div>attr_sql could be a good solution, the goal is to configure a Windows 10 that correctly presents itself with its proper identity, instead of its WAN IP as <a href="http://192.168.3.44" target="_blank">192.168.3.44</a>:<br></div><br>04[CFG] looking for peer configs matching 110.7.6.173[%any]...11.74.200.<wbr>151[192.168.3.44]<br>04[CFG] selected peer config 'ike2-eap-radius' <br><br>The same account, using nm-strongswan or charon-cmd, works great with Linux, the identity (Frank) is there:<br><br>15[CFG] looking for peer configs matching 110.7.6.173[%any]...11.74.200.<wbr>151[Frank]<br>15[CFG] selected peer config 'ike2-eap-Frank'<br><br></div><div>I'm also sure that this problem should be well know in Windows 10 clients, it looks so standard!<br></div><div>Any suggestions would be very appreciated<br></div><div><div><div><div><br></div></div></div></div></div>
</blockquote></div><br></div>