Strongswan Installation for CentOS 7

RADIUS Accounting in the eap-radius plugin does not require XAuth authentication. It actually works with any kind of authentication, via RADIUS or not, as long as the client requests a virtual IP address (for IKEv2 even this requirement can be disabled). With some IKEv1 clients there are some issues in case of reauthentication, though (see issue #937 and related).

EAP-TLS makes it possible to delegate the certificate authentication for IKEv2 clients to the AAA server, but this is unrelated to RADIUS Accounting.

There are two important aspects to this:

• Identities sent by the client (these are the identities seen in [] in the looking for peer configs matching... log message) must match the configured identities on the server (the remote identity, rightid, may be %any to accept any client identity - this is actually the default). The configured identities can be seen in the output of ipsec statusall.

• The identities used by client and server must be contained in the certificates, which usually means they have to be contained in a subjectAltName extension (subject DNs can't be used as server identities with many clients). Note that some clients match identities against e.g. CNs in DNs but e.g. strongSwan does not.

The latter means that when strongSwan loads a certificate and the configured server identity (leftid) doesn't match the full subject DN or any of the subjectAltName extensions it will fallback to the DN as identity (there is an appropriate log message and ipsec statusall will also show this change). So even if the client proposes the same identity configured in leftid it might not actually be the identity strongSwan then uses to find a configuration and authenticate itself.

So make sure the configured identities match on client and server and that these identities are confirmed by the certificates used during authentication.