<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi colleagues,</p>
<p>is there way to use different configs for different EAP ids when
using eap_radius?</p>
<p>In order to assign different if_id_in/out, I'm trying to do the
following:<br>
</p>
<pre>connections {
ikev2-eap {
remote {
auth = eap_radius
id = %any
eap_id = %any
}
children {
child {
if_id_in/out = 1
}
}
}
ikev2-eap-xfrm2 {
remote {
auth = eap_radius
id = %any
eap_id = <a class="moz-txt-link-abbreviated" href="mailto:doka.ua@gmx.com">doka.ua@gmx.com</a>
}
children {
child {
if_id_in/out = 2
updown = /etc/swanctl/bin/updown
}
}
}
</pre>
<p>but Strongswan matches by 'remote_id' (which is 'ID_IPV4_ADDR'
and makes no sense for roadwarriors) and chooses not more
specific:<br>
</p>
<pre>charon-systemd[7903]: looking for peer configs matching server_ip[%any]...remote_ip[192.0.2.225]
strongswan: 15[CFG] <3> peer config "ikev2-eap", ike match: 1052 (server_ip...%any IKEv2)
strongswan: 15[CFG] <3> local id match: 1 (ID_ANY: )
strongswan: 15[CFG] <3> remote id match: 1 (ID_IPV4_ADDR: c0:00:02:e1)
strongswan: 15[CFG] <3> candidate "ikev2-eap", match: 1/1/1052 (me/other/ike)
strongswan: 15[CFG] <3> peer config "ikev2-eap-xfrm2", ike match: 1052 (server_ip...%any IKEv2)
strongswan: 15[CFG] <3> local id match: 1 (ID_ANY: )
strongswan: 15[CFG] <3> remote id match: 0 (ID_IPV4_ADDR: c0:00:02:e1)
strongswan: 15[CFG] <ikev2-eap|3> selected peer config 'ikev2-eap'
charon-systemd[7903]: selected peer config 'ikev2-eap'
charon-systemd[7903]: initiating EAP_IDENTITY method (id 0x00)
charon-systemd[7903]: generating IKE_AUTH response 1 [ IDr CERT CERT AUTH EAP/REQ/ID ]
charon-systemd[7903]: parsed IKE_AUTH request 2 [ EAP/RES/ID ]
charon-systemd[7903]: received EAP identity '<a class="moz-txt-link-abbreviated" href="mailto:doka.ua@gmx.com">doka.ua@gmx.com</a>'
</pre>
<p>completely ignoring eap_id statement in 'remote' section.</p>
<p>So, the question - is there way to match connection by different
EAP ids when using eap_radius?</p>
<p>Thank you.<br>
</p>
<pre class="moz-signature" cols="72">--
Volodymyr Litovka
"Vision without Execution is Hallucination." -- Thomas Edison</pre>
</body>
</html>