[strongSwan] is it authenticate IPSec pre-shared keys (PSK) not from ipsec.secrets?
aae at sumix.com
Fri Sep 26 13:35:47 CEST 2014
Thanks a lot for your advices. Currently, I'm trying to discover
is my cisco RV082/RV200 EAP compatible. As far I understand, I can use
only PSK on these devices.
Reseller is not available. anyway, I have to check.
Could someone tell me client VPN Router which supports EAP.
I will find the docs and compare features with my RV082/RV200 ?
Thanks again for everyone.
On 25.09.14 15:54, Martin Willi wrote:
>> is there any possibility to authenticate IPSec pre-shared keys (PSK)
>> not from ipsec.secrets.
> As IKE PSK authentication has security implications and is not
> recommended for larger deployments, we don't provide any backend for
> preshared keys beyond ipsec.secrets or swanctl.conf. However, you may
> implement your own plugin that returns preshared keys from a custom
> source for authentication.
> Usually you'd use EAP that allows you to forward user authentication to
> your AAA backend using the eap-radius plugin .
>> It would be great for me to build some logic on radius server with
>> traditional start/stop/alive events..
> Such events can be realized using the accounting functionality in the
> eap-radius plugin. Even if you do authentication by other means,
> strongSwan can send such information to your AAA backend over RADIUS.
More information about the Users