Strongswan IKEv2 auth – pubkey and EAP

authenticationeapikev2strongswanvpn

I'am trying to setup strongswan with pubkey and EAP authentication. To login users need to have certificate and valid credentials.

My certificate is ok. I tested pubkey auth and it was ok, also EAP is working, but when i trying run this two auth methods at a same time i have auth error.

I tested this on win7 and on android (strongswan client).

How can i setup this ? Is it possible at all ?

#ipsec.conf

rightauth=pubkey
rightauth2=eap-mschapv2

#ipsec.secrets

username : EAP "password"

ver. strongSwan U5.3.5/K4.4.0-116-generic

Best Answer

Using two (or more) authentication methods in IKEv2 requires support for RFC 4739.

Unfortunately, a lot of clients don't support this, for instance, the built-in IKEv2 clients in Windows and macOS/iOS.

But combining certificate and username/password-based client authentication should work with the strongSwan Android app, if the client profile is configured appropriately ("IKEv2 Certificate + EAP (Username/Password)" is the VPN type to select there).

Related Solutions

Mysql – Use MySQL for storing secrets in Strongswan VPN

It doesn't store the secrets in plain text but it uses any kind of encryption to do so.

That's not the case. The secrets are stored in plain text. So just insert the shared secrets and identities as indicated on the referenced wiki page (using your example data):

/* type: ID_FQDN, data: arav */
INSERT INTO identities (type, data) VALUES (2, X'61726176');
/* type: SHARED_EAP, data: accessit */
INSERT INTO shared_secrets (type, data) VALUES (2, X'6361656373737469');
/* to associate the identity with the secret, use the actual ids of the two rows above */
INSERT INTO shared_secret_identity (shared_secret, identity) VALUES (1, 1);

Strongswan – Connecting PSK & EAP Simultaneously

This has been resolved. Still not sure why it happened.

The psk and username in my secrets file was same i.e, 'John'.

After i changed the psk to something else ,not similar to username of an EAP, it worked.

Best Answer

Related Solutions

Mysql – Use MySQL for storing secrets in Strongswan VPN

Strongswan – Connecting PSK & EAP Simultaneously

Related Topic