[strongSwan] eap-radius integration

[Steffen Plotner]

Hi,

After several days of not finding another path, I am trying to see what I have done wrong in terms of the eap-radius integration. It appears Strongswan is producing an Access-Request packet with the following attributes: User-name, NAS-Port-Type, Service-Type, NAS-Port, NAS-Port-Id, NAS-IP-Address, Called-Station-ID, Calling-Station-Id, EAP-Message (last segment), NAS-Identifier, Message-Authenticator.

One of the attributes for doing MS-CHAP-v2 is not in it. I thought that those might be vendor specific attributes 26:311 (I have experimented with the forwarding of attributes ike_to_radius = 26:311 but did not change anything).

I have configured the eap-radius servers in strongswan to point first to IAS 2003 and it fails, as it expects PEAP and cannot handle EAP-MS-Chap-v2. I have then pointed it to a Windows 2008 NPS server and it fails, with Access-Reject - looking at the packets I don't see the MS-CHAP-v2 Challenge attribute coming through. [Short version: the password is not coming through in the Access-Request when eap-radius is involved]

The configuration is under IKEv2 type, I was able to bypass the radius stuff by simply doing a righauth=eap-mschapv2 using a local secrets file. I wanted to switch to radius based authentication and authorization. The client is windows 7 - I have tried both EAP-MS-CHAPv2 and PEAP-MS-CHAPv2 with the eap-radius configuration and it did not work.

We are using strongswan-5.2.2 on centos6. I have looked at the examples and just cannot get the password to come through, only the attributes I initially listed.

Thank you for your help.

Steffen



_______________________________________________________________________________________________
Steffen Plotner                            Amherst College            Tel (413) 542-2348
Systems/Network Administrator/Programmer   PO BOX 5000                Fax (413) 542-2626
Systems & Networking                       Amherst, MA 01002-5000     swplotner at amherst.edu



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strongswan.org/pipermail/users/attachments/20150119/3fc78d0e/attachment.html>