<div dir="ltr">I have changed both configs to 127.0.0.1 and restarted both StrongSwan and FreeRadius but I got the same error message.<div>Then I changed them both to 0.0.0.0 and restarted both servers, and I still get the same error message.</div><div><br></div><div>Any idea what this could be?</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Nov 15, 2017 at 9:01 AM, Michael Schwartzkopff <span dir="ltr"><<a href="mailto:ms@sys4.de" target="_blank">ms@sys4.de</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">Am 15.11.2017 um 09:58 schrieb Houman:<br>
> Hallo Michael,<br>
><br>
><br>
> Thanks for your reply. Indeed I should have checked the radius log. It<br>
> seems the shared secret is incorrect, but there do match in configs as<br>
> pasted below.<br>
> Where else could the secret have been used that I have missed? Thanks<br>
><br>
</span>> *vim /var/log/freeradius/radius.<wbr>log*<br>
<div><div class="h5">><br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Attempting to connect to<br>
> database "radius"<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (0), 1 of 32 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (1), 1 of 31 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (2), 1 of 30 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (3), 1 of 29 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (4), 1 of 28 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: Need 5 more connections to reach 10 spares<br>
> Wed Nov 15 08:49:50 2017 : Info: rlm_sql (sql): Opening additional<br>
> connection (5), 1 of 27 pending slots used<br>
> Wed Nov 15 08:49:50 2017 : Info: Loaded virtual server <default><br>
> Wed Nov 15 08:49:50 2017 : Warning: Ignoring "ldap" (see<br>
> raddb/mods-available/README.<wbr>rst)<br>
> Wed Nov 15 08:49:50 2017 : Info: Loaded virtual server default<br>
> Wed Nov 15 08:49:50 2017 : Info: # Skipping contents of 'if' as it is<br>
> always 'false' -- /etc/freeradius/sites-enabled/<wbr>inner-tunnel:331<br>
> Wed Nov 15 08:49:50 2017 : Info: Loaded virtual server inner-tunnel<br>
> Wed Nov 15 08:49:50 2017 : Info: Ready to process requests<br>
> Wed Nov 15 08:49:57 2017 : Info: Dropping packet without response because<br>
> of error: Received packet from 127.0.0.1 with invalid<br>
> Message-Authenticator! (Shared secret is incorrect.)<br>
><br>
><br>
><br>
</div></div>> *vim /etc/strongswan.conf*<br>
<span class="">><br>
> charon {<br>
> load_modular = yes<br>
> compress = yes<br>
> plugins {<br>
> include strongswan.d/charon/*.conf<br>
> eap-radius {<br>
> servers {<br>
> server-a {<br>
> accounting = yes<br>
> secret = 123456<br>
> address = 127.0.0.1<br>
> auth_port = 1812<br>
> acct_port = 1813<br>
> }<br>
> }<br>
> }<br>
> }<br>
> include strongswan.d/*.conf<br>
> }<br>
><br>
><br>
><br>
</span>> *vim /etc/freeradius/clients.conf*<br>
<div><div class="h5">><br>
> client 0.0.0.0 {<br>
> secret = 123456<br>
> nas_type = other<br>
> shortname = 0.0.0.0<br>
> require_message_authenticator = no<br>
> }<br>
><br>
><br>
><br>
> On Wed, Nov 15, 2017 at 7:55 AM, Michael Schwartzkopff <<a href="mailto:ms@sys4.de">ms@sys4.de</a>> wrote:<br>
><br>
>> Am 15.11.2017 um 08:24 schrieb Houman:<br>
>>> Hi,<br>
>>><br>
>>> I'm new to the concept of EAP and might be misunderstanding something.<br>
>>> Apologies up front.<br>
>>><br>
>>> I have finally been able to install FreeRadius and enable the SQL module.<br>
>>> I have created a user in the database and was hoping to establish a VPN<br>
>>> connection via that user.<br>
>>><br>
>>> INSERT INTO radcheck (username,attribute,op,VALUE) VALUES<br>
>>> ('houman','Cleartext-Password'<wbr>,':=','test123');<br>
>>><br>
>>><br>
>>> When I try to connect from my MacBook into the StrongSwan server I get<br>
>> this<br>
>>> log. It looks promising but eventually, it says initiating EAP_RADIUS<br>
>>> method failed.<br>
>>><br>
>>> I'm not quite sure if this has failed due a bad configuration on my side<br>
>> or<br>
>>> it is for other reasons that I don't quite understand how EAP should<br>
>> work.<br>
>>> Please be so kind and advise,<br>
>>> Thanks,<br>
>>> Houman<br>
>>><br>
>>><br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[NET] received packet: from<br>
>>> 88.98.201.107[51247] to 172.31.9.51[500] (300 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[ENC] parsed IKE_SA_INIT<br>
>> request 0<br>
>>> [ SA KE No N(REDIR_SUP) N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[IKE] 88.98.201.107 is<br>
>> initiating<br>
>>> an IKE_SA<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[IKE] local host is behind NAT,<br>
>>> sending keep alives<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[IKE] remote host is behind NAT<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[ENC] generating IKE_SA_INIT<br>
>>> response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(MULT_AUTH)<br>
>> ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 13[NET] sending packet: from<br>
>>> 172.31.9.51[500] to 88.98.201.107[51247] (316 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[NET] received packet: from<br>
>>> 88.98.201.107[51248] to 172.31.9.51[4500] (344 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] unknown attribute type<br>
>> (25)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] parsed IKE_AUTH request 1<br>
>> [<br>
>>> IDi N(INIT_CONTACT) N(MOBIKE_SUP) IDr CPRQ(ADDR DHCP DNS MASK ADDR6 DHCP6<br>
>>> DNS6 (25)) N(ESP_TFC_PAD_N) N(NON_FIRST_FRAG) SA TSi TSr ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[CFG] looking for peer configs<br>
>>> matching 172.31.9.51[<a href="http://vpn2.t.com" rel="noreferrer" target="_blank">vpn2.t.com</a>]...88.<wbr>98.201.107[<a href="http://vpn2.t.com" rel="noreferrer" target="_blank">vpn2.t.com</a>]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[CFG] selected peer config<br>
>>> 'roadwarrior'<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] initiating EAP_IDENTITY<br>
>>> method (id 0x00)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] received<br>
>>> ESP_TFC_PADDING_NOT_SUPPORTED, not using ESPv3 TFC padding<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] peer supports MOBIKE<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] authentication of '<br>
>> <a href="http://vpn2.t.com" rel="noreferrer" target="_blank">vpn2.t.com</a>'<br>
>>> (myself) with RSA signature successful<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] sending end entity cert<br>
>> "CN=<br>
>>> <a href="http://vpn2.t.com" rel="noreferrer" target="_blank">vpn2.t.com</a>"<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[IKE] sending issuer cert "C=US,<br>
>>> O=Let's Encrypt, CN=Let's Encrypt Authority X3"<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] splitting IKE message with<br>
>>> length of 3334 bytes into 7 fragments<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(1/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(2/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(3/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(4/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(5/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(6/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 1 [ EF(7/7) ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[NET] sending packet: from<br>
>>> 172.31.9.51[4500] to 88.98.201.107[51248] (544 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: message repeated 5 times: [<br>
>> 14[NET]<br>
>>> sending packet: from 172.31.9.51[4500] to 88.98.201.107[51248] (544<br>
>> bytes)]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 14[NET] sending packet: from<br>
>>> 172.31.9.51[4500] to 88.98.201.107[51248] (440 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 15[NET] received packet: from<br>
>>> 88.98.201.107[51248] to 172.31.9.51[4500] (80 bytes)<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 15[ENC] parsed IKE_AUTH request 2<br>
>> [<br>
>>> EAP/RES/ID ]<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 15[IKE] received EAP identity<br>
>>> 'houman'<br>
>>> Nov 15 07:13:21 ip-172-31-9-51 charon: 15[CFG] sending RADIUS<br>
>>> Access-Request to server 'server-a'<br>
>>> Nov 15 07:13:23 ip-172-31-9-51 charon: 15[CFG] retransmit 1 of RADIUS<br>
>>> Access-Request (timeout: 2.8s)<br>
>>> Nov 15 07:13:24 ip-172-31-9-51 charon: 06[MGR] ignoring request with ID<br>
>> 2,<br>
>>> already processing<br>
>>> Nov 15 07:13:26 ip-172-31-9-51 charon: 15[CFG] retransmit 2 of RADIUS<br>
>>> Access-Request (timeout: 3.9s)<br>
>>> Nov 15 07:13:27 ip-172-31-9-51 charon: 05[MGR] ignoring request with ID<br>
>> 2,<br>
>>> already processing<br>
>>> Nov 15 07:13:30 ip-172-31-9-51 charon: 15[CFG] retransmit 3 of RADIUS<br>
>>> Access-Request (timeout: 5.5s)<br>
>>> Nov 15 07:13:30 ip-172-31-9-51 charon: 04[MGR] ignoring request with ID<br>
>> 2,<br>
>>> already processing<br>
>>> Nov 15 07:13:35 ip-172-31-9-51 charon: 15[CFG] RADIUS Access-Request<br>
>> timed<br>
>>> out after 4 attempts<br>
>>> Nov 15 07:13:35 ip-172-31-9-51 charon: 15[IKE] initiating EAP_RADIUS<br>
>> method<br>
>>> failed<br>
>>> Nov 15 07:13:35 ip-172-31-9-51 charon: 15[ENC] generating IKE_AUTH<br>
>> response<br>
>>> 2 [ EAP/FAIL ]<br>
>>> Nov 15 07:13:35 ip-172-31-9-51 charon: 15[NET] sending packet: from<br>
>>> 172.31.9.51[4500] to 88.98.201.107[51248] (65 bytes)<br>
>>><br>
>> It seems that your RADIUS server does not behave properly.<br>
>><br>
>> Is the server online?<br>
>><br>
>> Is the RADIUS service running?<br>
>><br>
>> What are the logs of the RADIUS server, or in other words, what is the<br>
>> output of freeradius -X?<br>
>><br>
>><br>
>> Mit freundlichen Grüßen,<br>
>><br>
>> --<br>
>><br>
>> [*] sys4 AG<br>
>><br>
>> <a href="https://sys4.de" rel="noreferrer" target="_blank">https://sys4.de</a>, <a href="tel:%2B49%20%2889%29%2030%2090%2046%2064" value="+498930904664">+49 (89) 30 90 46 64</a><br>
>> Schleißheimer Straße 26/MG,80333 München<br>
>><br>
>> Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263<br>
>> Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief<br>
>> Aufsichtsratsvorsitzender: Florian Kirstein<br>
>><br>
>><br>
>><br>
</div></div>Well, RADIUS accepts the client 0.0.0.0. But the client has the<br>
127.0.0.1. Please change the entry in the clients.conf of the freeradius<br>
setup.<br>
<div class="HOEnZb"><div class="h5"><br>
Mit freundlichen Grüßen,<br>
<br>
--<br>
<br>
[*] sys4 AG<br>
<br>
<a href="https://sys4.de" rel="noreferrer" target="_blank">https://sys4.de</a>, <a href="tel:%2B49%20%2889%29%2030%2090%2046%2064" value="+498930904664">+49 (89) 30 90 46 64</a><br>
Schleißheimer Straße 26/MG,80333 München<br>
<br>
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263<br>
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief<br>
Aufsichtsratsvorsitzender: Florian Kirstein<br>
<br>
<br>
</div></div></blockquote></div><br></div>