<div dir="ltr"><div dir="ltr"><div dir="ltr">Tobias,<div><br></div><div>Makes total sense.</div><div><br></div><div>So my production environment doesn't have EAP-MSCHAPv2! That was a revelation. So unloading PEAP, and connecting to a server with EAP-MSCHAPv2 enabled (DEV) things work.</div><div><br></div></div></div><blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[CFG] certificate status is good</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[CFG] reached self-signed root ca with a path length of 2</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[IKE] authentication of 'CN=<a href="http://vpn.company.com">vpn.company.com</a>' with RSA signature successful</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[IKE] server requested EAP_IDENTITY (id 0xD1), sending 'user'</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[ENC] generating IKE_AUTH request 2 [ EAP/RES/ID ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 07[NET] sending packet: from 192.168.1.125[40071] to y.y.y.y[4500] (96 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 06[NET] received packet: from y.y.y.y[4500] to 192.168.1.125[40071] (112 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 06[ENC] parsed IKE_AUTH response 2 [ EAP/REQ/MSCHAPV2 ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 06[IKE] server requested EAP_MSCHAPV2 authentication (id 0xD2)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 06[ENC] generating IKE_AUTH request 3 [ EAP/RES/MSCHAPV2 ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 06[NET] sending packet: from 192.168.1.125[40071] to y.y.y.y[4500] (144 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 15[NET] received packet: from y.y.y.y[4500] to 192.168.1.125[40071] (128 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 15[ENC] parsed IKE_AUTH response 3 [ EAP/REQ/MSCHAPV2 ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 15[IKE] EAP-MS-CHAPv2 succeeded: '(null)'</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 15[ENC] generating IKE_AUTH request 4 [ EAP/RES/MSCHAPV2 ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 15[NET] sending packet: from 192.168.1.125[40071] to y.y.y.y[4500] (80 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[NET] received packet: from y.y.y.y[4500] to 192.168.1.125[40071] (80 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[ENC] parsed IKE_AUTH response 4 [ EAP/SUCC ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[IKE] EAP method EAP_MSCHAPV2 succeeded, MSK established</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[IKE] authentication of 'user' (myself) with EAP</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[ENC] generating IKE_AUTH request 5 [ AUTH ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 11[NET] sending packet: from 192.168.1.125[40071] to y.y.y.y[4500] (112 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 10[NET] received packet: from y.y.y.y[4500] to 192.168.1.125[40071] (288 bytes)</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 10[ENC] parsed IKE_AUTH response 5 [ IDr AUTH CPRP(ADDR DNS) N(MSG_ID_SYN_SUP) N(AUTH_LFT) SA TSi TSr ]</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 10[IKE] authentication of 'CN=<a href="http://vpn.company.com">vpn.company.com</a>' with EAP successful</div></div></div></div><div><div><div><div>Apr 17 22:00:55 ubuntu-desktop charon-nm: 10[IKE] IKE_SA NI VPN[6] established between 192.168.1.125[user]...y.y.y.y[CN=<a href="http://vpn.company.com">vpn.company.com</a>]</div></div></div></div><div><br></div></blockquote><div dir="ltr"><div dir="ltr"><div>So I guess the question is, what's the security risk here? I always knew that with PEAP, there is PKI as an outer method. What am I missing without that outer method encryption. Guess I need to read some more....</div><div><br></div><div>Here is my strongswan.conf in case anyone else is interested.</div><div><br></div><div>Thanks,</div><div>Chris.</div><div><br></div></div><blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px"><div><div># strongswan.conf - strongSwan configuration file</div></div><div><div>#</div></div><div><div># Refer to the strongswan.conf(5) manpage for details</div></div><div><div>#</div></div><div><div># Configuration changes should be made in the included files</div></div><div><div><br></div></div><div><div>charon {</div></div><div><div> charon-nm.plugins.eap-peap.load = no</div></div><div><div> plugins {</div></div><div><div> include strongswan.d/charon/*.conf</div></div><div><div> }</div></div><div><div>}</div></div><div><div><br></div></div><div><div>include strongswan.d/*.conf</div></div></blockquote><div dir="ltr"><div><br></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 17, 2019 at 1:48 AM Tobias Brunner <<a href="mailto:tobias@strongswan.org" target="_blank">tobias@strongswan.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Chris,<br>
<br>
The NM plugin currently does not provide an option to configure the<br>
expected AAA server identity. So the IKE identity is reused and<br>
enforced. This will fail if the AAA server uses a different identity<br>
during EAP-PEAP/(T)TLS:<br>
<br>
> [IKE] authentication of 'CN=<a href="http://vpn.company.com" rel="noreferrer" target="_blank">vpn.company.com</a>' with RSA signature successful<br>
> ...<br>
> [TLS] server certificate does not match to 'CN=<a href="http://vpn.company.com" rel="noreferrer" target="_blank">vpn.company.com</a>'<br>
<br>
<br>
> What we found key was the leftauth method has to be eap-mschapv2. That<br>
> doesn't seem to be avavailbe in the network manager config.<br>
<br>
While the authentication method can't be configured explicitly in the NM<br>
plugin, you can prevent the ẹap-peap plugin from getting loaded so plain<br>
EAP-MSCHAPv2 will be used. To do so configure<br>
charon-nm.plugins.eap-peap.load = no in strongswan.conf (note that this<br>
requires at least 5.5.0 to work, in older releases the complete list of<br>
plugins has to be provided in charon-nm.load, see [1] for details).<br>
<br>
Regards,<br>
Tobias<br>
<br>
[1] <a href="https://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad" rel="noreferrer" target="_blank">https://wiki.strongswan.org/projects/strongswan/wiki/PluginLoad</a><br>
</blockquote></div>