[strongSwan] fallback to local secrets when RADIUS server unavailable

[Dmitry Soloshenko]

Hello,

I'm using Strongswan for remote user access to server infrastructure on
remote site. Currently I'm using eap-radius authentication with Windows
NPS and it works fine. The right auth part of conn config:

      right=%any
      rightauth=eap-radius
      rightsendcert=never
      eap_identity=%identity

I would like to have a possibility to authenticate technical support
users with local secrets (i.e. rightauth=eap-mschapv2) in case of RADIUS
server unavailability. Is there a way to have 2 auth methods
simultaneously for right=%any anyhow? Or maybe some fallback mechanism?

Now I see the only way is to have separate public IP on external
Strongswan interface and have another conn section for this IP. It seems
not very straightforward solution.

As an example, on Cisco router I would create 2 access groups and have 2
profiles on Cisco VPN client: one for local auth, one for RADIUS.

Any thoughts? Technical support clients are mostly Windows built-in VPN.

--
Best regards,
Dmitry Soloshenko