Hello all,
I am trying to set a VPN between Strongswan on Linux and a Fortigate 60C
(FortiOS 5.2.4), in IKEv2 EAP identity.
The Fortigate sends the EAP_IDENTITY and Strongswan answers with EAP_IDENTITY,
and Fortigate does not answer any more (see traces below).
Does anyone already use Fortigate 60C in IKEv2 EAP mode ?
Thanks and regards
Denis
# ipsec.conf - strongSwan IPsec configuration file
config setup
charondebug="cfg 2, chd 2, dmn 2, esp 2, ike 2, knl 2, mgr 2"
# Add connections here.
conn %default
keyexchange=ikev2
# Sample VPN connections
conn vpn_FGT
left=X.X.X.82
leftsourceip=%config
leftauth=psk
leftfirewall=yes
leftid=172.26.185.82
auto=start
ike=aes256-sha256-modp2048
esp=aes256-sha256-modp2048
right=X.X.X.50
rightsubnet=X.X.X.50/32
rightid=%any
rightauth=eap
Sep 15 14:59:11 (none) charon: 09[CFG] configured proposals:
ESP:AES_CBC_256/HMAC_SHA2_256_128/NO_EXT_SEQ,
ESP:AES_CBC_128/AES_CBC_192/AES_CBC_256/3DES_CBC/BLOWFISH_CBC_256/HMAC_SHA1_96/AES_XCBC_96/HMAC_MD5_96/NO_EXT_SEQ
Sep 15 14:59:11 (none) charon: 09[KNL] got SPI c424fe4c
Sep 15 14:59:11 (none) charon: 09[ENC] generating IKE_AUTH request 1 [ IDi
CPRQ(ADDR DNS) SA TSi TSr N(MOBIKE_SUP) N(NO_ADD_ADDR) N(EAP_ONLY) ]
Sep 15 14:59:11 (none) charon: 09[NET] sending packet: from X.X.X.82[4500] to
X.X.X.50[4500] (336 bytes)
Sep 15 14:59:11 (none) charon: 09[MGR] checkin IKE_SA vpn_FGT[1]
Sep 15 14:59:11 (none) charon: 10[MGR] checkout IKE_SA by message
Sep 15 14:59:11 (none) charon: 09[MGR] check-in of IKE_SA successful.
Sep 15 14:59:11 (none) charon: 10[MGR] IKE_SA vpn_FGT[1] successfully checked
out
Sep 15 14:59:11 (none) charon: 10[NET] received packet: from X.X.X.50[4500] to
X.X.X.82[4500] (192 bytes)
Sep 15 14:59:11 (none) charon: 10[ENC] parsed IKE_AUTH response 1 [ IDr AUTH
EAP/REQ/ID ]
Sep 15 14:59:11 (none) charon: 10[IKE] authentication of 'X.X.X.50' with
pre-shared key successful
Sep 15 14:59:11 (none) charon: 10[IKE] server requested EAP_IDENTITY (id 0x95),
sending 'X.X.X.82'
Sep 15 14:59:11 (none) charon: 10[IKE] reinitiating already active tasks
Sep 15 14:59:11 (none) charon: 10[IKE] IKE_AUTH task
Sep 15 14:59:11 (none) charon: 10[ENC] generating IKE_AUTH request 2 [
EAP/RES/ID ]
Sep 15 14:59:11 (none) charon: 10[NET] sending packet: from X.X.X.82[4500] to
X.X.X.50[4500] (96 bytes)
Sep 15 14:59:11 (none) charon: 10[MGR] checkin IKE_SA vpn_FGT[1]
Sep 15 14:59:11 (none) charon: 10[MGR] check-in of IKE_SA successful.
Sep 15 14:59:13 (none) charon: 11[CFG] proposing traffic selectors for us:
Sep 15 14:59:13 (none) charon: 11[CFG] dynamic
Sep 15 14:59:13 (none) charon: 11[CFG] proposing traffic selectors for other:
Sep 15 14:59:13 (none) charon: 11[CFG] X.X.X.50/32
Sep 15 14:59:15 (none) charon: 06[MGR] checkout IKE_SA
Sep 15 14:59:15 (none) charon: 06[MGR] IKE_SA vpn_FGT[1] successfully checked
out
Sep 15 14:59:15 (none) charon: 06[MGR] checkin IKE_SA vpn_FGT[1]
Sep 15 14:59:15 (none) charon: 06[MGR] check-in of IKE_SA successful.
Sep 15 14:59:15 (none) charon: 08[MGR] checkout IKE_SA
Sep 15 14:59:15 (none) charon: 08[MGR] IKE_SA vpn_FGT[1] successfully checked
out
Sep 15 14:59:15 (none) charon: 08[MGR] checkin IKE_SA vpn_FGT[1]
Sep 15 14:59:15 (none) charon: 08[MGR] check-in of IKE_SA successful.
Sep 15 14:59:15 (none) charon: 13[MGR] checkout IKE_SA
Sep 15 14:59:15 (none) charon: 13[MGR] IKE_SA vpn_FGT[1] successfully checked
out
Sep 15 14:59:15 (none) charon: 13[IKE] retransmit 1 of request with message ID 2
Sep 15 14:59:15 (none) charon: 13[NET] sending packet: from X.X.X.82[4500] to
X.X.X.50[4500] (96 bytes)
Sep 15 14:59:15 (none) charon: 13[MGR] checkin IKE_SA vpn_FGT[1]
_______________________________________________
Users mailing list
Users@lists.strongswan.org
https://lists.strongswan.org/mailman/listinfo/users
