<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Hi,<div class=""><br class=""></div><div class="">I use route-based VPNs for lot of different clients and, unfortunately, met with Cisco ASA. Can’t say I’m delighted - unlike others, it does not support neither EAP-MSCHAPv2 nor VIP negotiation for route-based VPNs, which makes it impossible to use Radius as authentication/authorization backend and introduces necessity to describe remote_ts and secret per connection, like this:</div><div class=""><br class=""></div><div class=""><div class="">ikev2-psk {</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>[ ... ]</div><div class=""> remote {</div><div class=""> auth = psk</div><div class=""> id = ciscoasa</div><div class=""> }</div><div class=""> children {</div><div class=""> psk-child {</div><div class=""> local_ts = 0.0.0.0/0</div><div class=""> remote_ts = 172.29.24.100/32</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>}</div><div class="">}</div><div class=""><br class=""></div><div class="">secrets {</div><div class=""> ike-1 {</div><div class=""> id = ciscoasa</div><div class=""> secret = q1w2e3</div><div class=""> }</div><div class="">}</div><div class=""><br class=""></div><div class="">I’m just wondering, is it, nevertheless, possible to use Radius for configuring at least Strongswan side in such cases? What I mean: use id/psk to authenticate connection in Radius and get VIP from Radius to provision ‘remote_ts’ parameter and configure xfrm policies (ignoring "expected a virtual IP request, sending FAILED_CP_REQUIRED” and leaving IP configuration on remote side to be configured statically).</div><div class=""><br class=""></div><div class="">This approach do not break protocols itself (because applicable to gateway side only), but reduce configuration, keeping PSK config common for all connections, like this:</div><div class=""><br class=""></div><div class=""><div class="">ikev2-psk {</div><div class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>[ ... ]</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span><b class="">pools = radius</b></div><div class=""><b class=""><span class="Apple-tab-span" style="white-space:pre"> </span>vip_rq = (yes|no)</b></div><div class=""> remote {</div><div class=""> auth = <b class="">psk-radius(?)</b></div><div class=""> id = %any</div><div class=""> }</div><div class=""> children {</div><div class=""> psk-child {</div><div class=""> local_ts = 0.0.0.0/0</div><div class=""> remote_ts = <b class="">dynamic</b></div><div class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>}</div><div class=""><span class="Apple-tab-span" style="white-space: pre;"> </span>}</div><div class="">}</div></div><div class=""><br class=""></div><div class="">Any thoughts on whether can be implemented either internally or using external scripts/hooks upon connection establishing?</div><div class=""><br class="webkit-block-placeholder"></div><div class="">
<div>Thank you.</div><div><br class="">-- <br class="">Volodymyr Litovka<br class=""> "Vision without Execution is Hallucination." -- Thomas Edison</div>
</div>
<br class=""></div></body></html>