invalid payload received #1054

Nelse74 · 2022-05-18T14:25:42Z

Nelse74
May 18, 2022

Good afternoon,

I've been successful in building a ntlm_auth with mschap authentication using ikev2 eap-radius and a freeradius authenticated agaisn't a samba ad.
It worked great this week and I was improving some of the files by adding comments, removing some options and all.
After some time when I try to connect i get the invalid payload received on my windows client.
I've been searching for some hours, put the options back. Looking on the internet and log files didn't really provide me of any solution.
Saying it like that sounds lazy, but I don't really understand why it would just stop working out of the blue... In my opinion the Samba is the problem since I had to redo it this morning even though it was working fine with it 2 hours ago.

Here are the logs files from strongSwan :

mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[NET] received packet: from 172.16.80.220[500] to 172.16.80.241[500] (384 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] received MS-Negotiation Discovery Capable vendor ID
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] received Vid-Initial-Contact vendor ID
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] 172.16.80.220 is initiating an IKE_SA
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] 172.16.80.220 is initiating an IKE_SA
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[IKE] faking NAT situation to enforce UDP encapsulation
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[NET] sending packet: from 172.16.80.241[500] to 172.16.80.220[500] (296 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (588 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (168 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[ENC] parsed IKE_AUTH request 12 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[ENC] generating IKE_AUTH response 12 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[ENC] parsed IKE_AUTH request 13 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[CFG] received RADIUS Access-Accept from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[IKE] RADIUS authentication of 'alexis' successful
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[IKE] EAP method EAP_PEAP succeeded, MSK established
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[ENC] generating IKE_AUTH response 13 [ EAP/SUCC ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[ENC] parsed IKE_AUTH request 14 [ AUTH ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] authentication of '172.16.80.220' with EAP successful
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] authentication of '172.16.80.241' (myself) with EAP
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] IKE_SA branchet[1] established between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] peer requested virtual IP %any6
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] no virtual IP found for %any6 requested by 'alexis'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] no virtual IP found, sending INTERNAL_ADDRESS_FAILURE
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] configuration payload negotiation failed, no CHILD_SA built
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[IKE] failed to establish CHILD_SA, keeping IKE_SA
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[CFG] sending RADIUS Accounting-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[CFG] received RADIUS Accounting-Response from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[ENC] generating IKE_AUTH response 14 [ AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(INT_ADDR_FAIL) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (168 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[ENC] parsed IKE_AUTH request 1 [ EF(1/2) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[ENC] parsed INFORMATIONAL request 15 [ D ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[IKE] received DELETE for IKE_SA branchet[1]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[IKE] deleting IKE_SA branchet[1] between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[IKE] IKE_SA deleted
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[CFG] sending RADIUS Accounting-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[CFG] received RADIUS Accounting-Response from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[ENC] generating INFORMATIONAL response 15 [ ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[NET] received packet: from 172.16.80.220[500] to 172.16.80.241[500] (384 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[ENC] parsed IKE_SA_INIT request 0 [ SA KE No N(FRAG_SUP) N(NATD_S_IP) N(NATD_D_IP) V V V V ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[IKE] received MS NT5 ISAKMPOAKLEY v9 vendor ID
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[IKE] received MS-Negotiation Discovery Capable vendor ID
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[IKE] received Vid-Initial-Contact vendor ID
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[ENC] received unknown vendor ID: 01:52:8b:bb:c0:06:96:12:18:49:ab:9a:1c:5b:2a:51:00:00:00:02
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[IKE] 172.16.80.220 is initiating an IKE_SA
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[CFG] selected proposal: IKE:AES_CBC_256/HMAC_SHA2_384_192/PRF_HMAC_SHA2_384/ECP_384
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[IKE] faking NAT situation to enforce UDP encapsulation
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[ENC] generating IKE_SA_INIT response 0 [ SA KE No N(NATD_S_IP) N(NATD_D_IP) N(FRAG_SUP) N(CHDLESS_SUP) N(MULT_AUTH) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 16[NET] sending packet: from 172.16.80.241[500] to 172.16.80.220[500] (296 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 05[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (588 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 05[ENC] parsed IKE_AUTH request 1 [ EF(1/2) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 05[ENC] received fragment #1 of 2, waiting for complete IKE message
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (204 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] received fragment #2 of 2, reassembled fragmented IKE message (696 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR6 DNS6 SRV6) SA TSi TSr ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] received cert request for "CN=Linkso VPN CA"
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] received 19 cert requests for an unknown ca
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[ENC] received fragment #1 of 2, waiting for complete IKE message
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[CFG] looking for peer configs matching 172.16.80.241[%any]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[CFG] selected peer config 'branchet'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (204 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] parsed IKE_AUTH request 1 [ EF(2/2) ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] received fragment #2 of 2, reassembled fragmented IKE message (696 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] parsed IKE_AUTH request 1 [ IDi CERTREQ N(MOBIKE_SUP) CPRQ(ADDR6 DNS6 SRV6) SA TSi TSr ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] received cert request for "CN=Linkso VPN CA"
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] received 19 cert requests for an unknown ca
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[CFG] looking for peer configs matching 172.16.80.241[%any]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[CFG] selected peer config 'branchet'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] initiating EAP_IDENTITY method (id 0x00)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] peer supports MOBIKE
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] authentication of '172.16.80.241' (myself) with RSA signature successful
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] sending end entity cert "CN=172.16.80.241"
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] splitting IKE message (1928 bytes) into 2 fragments
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1244 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (764 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (104 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] received EAP identity 'alexis'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] initiating EAP_MD5 method (id 0x01)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MD5 ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (104 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[ENC] parsed IKE_AUTH request 3 [ EAP/RES/NAK ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[ENC] generating IKE_AUTH response 3 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (264 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[ENC] parsed IKE_AUTH request 4 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[ENC] generating IKE_AUTH response 4 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 09[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1096 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[ENC] parsed IKE_AUTH request 5 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[ENC] generating IKE_AUTH response 5 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 10[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1080 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[ENC] parsed IKE_AUTH request 6 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[ENC] generating IKE_AUTH response 6 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 12[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1080 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[ENC] parsed IKE_AUTH request 7 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[ENC] generating IKE_AUTH response 7 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 11[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (376 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (216 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[ENC] parsed IKE_AUTH request 8 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[ENC] generating IKE_AUTH response 8 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 13[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[ENC] parsed IKE_AUTH request 9 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[ENC] generating IKE_AUTH response 9 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 14[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] initiating EAP_IDENTITY method (id 0x00)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] peer supports MOBIKE
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] authentication of '172.16.80.241' (myself) with RSA signature successful
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[IKE] sending end entity cert "CN=172.16.80.241"
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] generating IKE_AUTH response 1 [ IDr CERT AUTH EAP/REQ/ID ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] splitting IKE message (1928 bytes) into 2 fragments
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] generating IKE_AUTH response 1 [ EF(1/2) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[ENC] generating IKE_AUTH response 1 [ EF(2/2) ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1244 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 06[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (764 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (104 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[ENC] parsed IKE_AUTH request 2 [ EAP/RES/ID ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[IKE] received EAP identity 'alexis'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[IKE] initiating EAP_MD5 method (id 0x01)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[ENC] generating IKE_AUTH response 2 [ EAP/REQ/MD5 ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 07[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (104 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[ENC] parsed IKE_AUTH request 3 [ EAP/RES/NAK ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[ENC] generating IKE_AUTH response 3 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 08[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (264 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[ENC] parsed IKE_AUTH request 4 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[ENC] generating IKE_AUTH response 4 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 09[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1096 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[ENC] parsed IKE_AUTH request 5 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[ENC] parsed IKE_AUTH request 10 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[ENC] generating IKE_AUTH response 5 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 10[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1080 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[ENC] parsed IKE_AUTH request 6 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[ENC] generating IKE_AUTH response 6 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 12[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (1080 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[ENC] parsed IKE_AUTH request 7 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[ENC] generating IKE_AUTH response 7 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 11[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (376 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (216 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[ENC] parsed IKE_AUTH request 8 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[ENC] generating IKE_AUTH response 8 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 13[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[ENC] parsed IKE_AUTH request 9 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[ENC] generating IKE_AUTH response 9 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 14[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 15[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain strongswan[1820]: 15[ENC] parsed IKE_AUTH request 10 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[ENC] generating IKE_AUTH response 10 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 15[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (152 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (184 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[ENC] parsed IKE_AUTH request 11 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[ENC] generating IKE_AUTH response 11 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 16[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (168 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (120 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[ENC] parsed IKE_AUTH request 12 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[CFG] received RADIUS Access-Challenge from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[ENC] generating IKE_AUTH response 12 [ EAP/REQ/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 05[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] parsed IKE_AUTH request 13 [ EAP/RES/PEAP ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[CFG] sending RADIUS Access-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[CFG] received RADIUS Access-Accept from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] RADIUS authentication of 'alexis' successful
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[IKE] EAP method EAP_PEAP succeeded, MSK established
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[ENC] generating IKE_AUTH response 13 [ EAP/SUCC ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 06[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (136 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[ENC] parsed IKE_AUTH request 14 [ AUTH ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] authentication of '172.16.80.220' with EAP successful
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] authentication of '172.16.80.241' (myself) with EAP
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] IKE_SA branchet[2] established between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] IKE_SA branchet[2] established between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] peer requested virtual IP %any6
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] no virtual IP found for %any6 requested by 'alexis'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] no virtual IP found, sending INTERNAL_ADDRESS_FAILURE
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] configuration payload negotiation failed, no CHILD_SA built
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[IKE] failed to establish CHILD_SA, keeping IKE_SA
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[CFG] sending RADIUS Accounting-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[CFG] received RADIUS Accounting-Response from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[ENC] generating IKE_AUTH response 14 [ AUTH N(MOBIKE_SUP) N(NO_ADD_ADDR) N(INT_ADDR_FAIL) ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 07[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (168 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[NET] received packet: from 172.16.80.220[4500] to 172.16.80.241[4500] (88 bytes)
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[ENC] parsed INFORMATIONAL request 15 [ D ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[IKE] received DELETE for IKE_SA branchet[2]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[IKE] deleting IKE_SA branchet[2] between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[IKE] deleting IKE_SA branchet[2] between 172.16.80.241[172.16.80.241]...172.16.80.220[172.16.80.220]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[IKE] IKE_SA deleted
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[IKE] IKE_SA deleted
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[CFG] sending RADIUS Accounting-Request to server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[CFG] received RADIUS Accounting-Response from server '172.16.80.249'
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[ENC] generating INFORMATIONAL response 15 [ ]
mai 18 16:10:10 strongswan.localdomain charon[1824]: 08[NET] sending packet: from 172.16.80.241[4500] to 172.16.80.220[4500] (88 bytes)

Radius :

(9) Received Access-Request Id 81 from 172.16.80.241:47107 to 172.16.80.249:1812 length 264
(9) User-Name = "alexis"
(9) NAS-Port-Type = Virtual
(9) Service-Type = Framed-User
(9) NAS-Port = 4
(9) NAS-Port-Id = "branchet"
(9) NAS-IP-Address = 172.16.80.241
(9) Called-Station-Id = "172.16.80.241[4500]"
(9) Calling-Station-Id = "172.16.80.220[4500]"
(9) Acct-Session-Id = "1652882748-4"
(9) EAP-Message = 0x02090060190017030300550000000000000002f26dd80b27774ad705b2b1bf13d8a23443a05134b3d9fec47bc75b9537581964b009dda222592bdcba954737945330bfe29977a4f9626650db08d3460eb8a734bb0476716124220733a39f2085
(9) NAS-Identifier = "strongSwan"
(9) State = 0xf2d7523dfade4b91d3be03f8478baaed
(9) Message-Authenticator = 0x50c8fb826cb2faa400a11299bfb03651
(9) Restoring &session-state
(9) &session-state:Framed-MTU = 994
(9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone"
(9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange"
(9) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec"
(9) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished"
(9) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(9) &session-state:TLS-Session-Version = "TLS 1.2"
(9) # Executing section authorize from file /etc/raddb/sites-enabled/default
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]@/ ) {
(9) if (&User-Name =~ /@[^@]@/ ) -> FALSE
(9) if (&User-Name =~ /../ ) {
(9) if (&User-Name =~ /../ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) -> FALSE
(9) if (&User-Name =~ /.$/) {
(9) if (&User-Name =~ /.$/) -> FALSE
(9) if (&User-Name =~ /@./) {
(9) if (&User-Name =~ /@./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [preprocess] = ok
(9) [chap] = noop
(9) [mschap] = noop
(9) [digest] = noop
(9) ntdomain: Checking for prefix before ""
(9) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(9) ntdomain: No such realm "NULL"
(9) [ntdomain] = noop
(9) eap: Peer sent EAP Response (code 2) ID 9 length 96
(9) eap: Continuing tunnel setup
(9) [eap] = ok
(9) } # authorize = ok
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) authenticate {
(9) eap: Expiring EAP session with state 0x34242e31342d34e4
(9) eap: Finished EAP session with state 0xf2d7523dfade4b91
(9) eap: Previous EAP request found for state 0xf2d7523dfade4b91, released from the list
(9) eap: Peer sent packet with method EAP PEAP (25)
(9) eap: Calling submodule eap_peap to process data
(9) eap_peap: (TLS) EAP Done initial handshake
(9) eap_peap: Session established. Decoding tunneled attributes
(9) eap_peap: PEAP state phase2
(9) eap_peap: EAP method MSCHAPv2 (26)
(9) eap_peap: Got tunneled request
(9) eap_peap: EAP-Message = 0x020900411a0209003c31a2d60864d465d2cc8a0dd07197bca7f600000000000000000d563774bb8d5a12c0c327c0c760eaf3ea75f20c9fa0333a00616c65786973
(9) eap_peap: Setting User-Name to alexis
(9) eap_peap: Sending tunneled request to inner-tunnel
(9) eap_peap: EAP-Message = 0x020900411a0209003c31a2d60864d465d2cc8a0dd07197bca7f600000000000000000d563774bb8d5a12c0c327c0c760eaf3ea75f20c9fa0333a00616c65786973
(9) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(9) eap_peap: User-Name = "alexis"
(9) eap_peap: State = 0x34242e31342d34e42a5abc6d3b098d54
(9) Virtual server inner-tunnel received request
(9) EAP-Message = 0x020900411a0209003c31a2d60864d465d2cc8a0dd07197bca7f600000000000000000d563774bb8d5a12c0c327c0c760eaf3ea75f20c9fa0333a00616c65786973
(9) FreeRADIUS-Proxied-To = 127.0.0.1
(9) User-Name = "alexis"
(9) State = 0x34242e31342d34e42a5abc6d3b098d54
(9) WARNING: Outer and inner identities are the same. User privacy is compromised.
(9) server inner-tunnel {
(9) session-state: No cached attributes
(9) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
(9) authorize {
(9) policy filter_username {
(9) if (&User-Name) {
(9) if (&User-Name) -> TRUE
(9) if (&User-Name) {
(9) if (&User-Name =~ / /) {
(9) if (&User-Name =~ / /) -> FALSE
(9) if (&User-Name =~ /@[^@]@/ ) {
(9) if (&User-Name =~ /@[^@]@/ ) -> FALSE
(9) if (&User-Name =~ /../ ) {
(9) if (&User-Name =~ /../ ) -> FALSE
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) {
(9) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) -> FALSE
(9) if (&User-Name =~ /.$/) {
(9) if (&User-Name =~ /.$/) -> FALSE
(9) if (&User-Name =~ /@./) {
(9) if (&User-Name =~ /@./) -> FALSE
(9) } # if (&User-Name) = notfound
(9) } # policy filter_username = notfound
(9) [chap] = noop
(9) [mschap] = noop
(9) ntdomain: Checking for prefix before ""
(9) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(9) ntdomain: No such realm "NULL"
(9) [ntdomain] = noop
(9) update control {
(9) &Proxy-To-Realm := LOCAL
(9) } # update control = noop
(9) eap: Peer sent EAP Response (code 2) ID 9 length 65
(9) eap: No EAP Start, assuming it's an on-going EAP conversation
(9) [eap] = updated
(9) [files] = noop
(9) if (noop && User-Password) {
(9) if (noop && User-Password) -> FALSE
(9) [expiration] = noop
(9) [logintime] = noop
(9) [pap] = noop
(9) } # authorize = updated
(9) Found Auth-Type = eap
(9) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(9) authenticate {
(9) eap: Expiring EAP session with state 0x34242e31342d34e4
(9) eap: Finished EAP session with state 0x34242e31342d34e4
(9) eap: Previous EAP request found for state 0x34242e31342d34e4, released from the list
(9) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(9) eap: Calling submodule eap_mschapv2 to process data
(9) eap_mschapv2: # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(9) eap_mschapv2: authenticate {
(9) mschap: Creating challenge hash with username: alexis
(9) mschap: Client is using MS-CHAPv2
(9) mschap: Executing: /usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{mschap:User-Name} --domain=VPNLINKSO --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}:
(9) mschap: EXPAND --username=%{mschap:User-Name}
(9) mschap: --> --username=alexis
(9) mschap: Creating challenge hash with username: alexis
(9) mschap: EXPAND --challenge=%{mschap:Challenge:-00}
(9) mschap: --> --challenge=08a67f91baf5aa3b
(9) mschap: EXPAND --nt-response=%{mschap:NT-Response:-00}
(9) mschap: --> --nt-response=0d563774bb8d5a12c0c327c0c760eaf3ea75f20c9fa0333a
(9) mschap: Program returned code (0) and output 'NT_KEY: 55C934A6CC2D6F45F910DAB58D6ACB60'
(9) mschap: Adding MS-CHAPv2 MPPE keys
(9) eap_mschapv2: [mschap] = ok
(9) eap_mschapv2: } # authenticate = ok
(9) eap_mschapv2: MSCHAP Success
(9) eap: Sending EAP Request (code 1) ID 10 length 51
(9) eap: EAP session adding &reply:State = 0x34242e31352e34e4
(9) [eap] = handled
(9) } # authenticate = handled
(9) } # server inner-tunnel
(9) Virtual server sending reply
(9) EAP-Message = 0x010a00331a0309002e533d42353042334343463943443231363731453333464333303734413338314342314545453730463339
(9) Message-Authenticator = 0x00000000000000000000000000000000
(9) State = 0x34242e31352e34e42a5abc6d3b098d54
(9) eap_peap: Got tunneled reply code 11
(9) eap_peap: EAP-Message = 0x010a00331a0309002e533d42353042334343463943443231363731453333464333303734413338314342314545453730463339
(9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap: State = 0x34242e31352e34e42a5abc6d3b098d54
(9) eap_peap: Got tunneled reply RADIUS code 11
(9) eap_peap: EAP-Message = 0x010a00331a0309002e533d42353042334343463943443231363731453333464333303734413338314342314545453730463339
(9) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(9) eap_peap: State = 0x34242e31352e34e42a5abc6d3b098d54
(9) eap_peap: Got tunneled Access-Challenge
(9) eap: Sending EAP Request (code 1) ID 10 length 82
(9) eap: EAP session adding &reply:State = 0xf2d7523dfbdd4b91
(9) [eap] = handled
(9) } # authenticate = handled
(9) Using Post-Auth-Type Challenge
(9) # Executing group from file /etc/raddb/sites-enabled/default
(9) Challenge { ... } # empty sub-section is ignored
(9) session-state: Saving cached attributes
(9) Framed-MTU = 994
(9) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone"
(9) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange"
(9) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec"
(9) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished"
(9) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(9) TLS-Session-Version = "TLS 1.2"
(9) Sent Access-Challenge Id 81 from 172.16.80.249:1812 to 172.16.80.241:47107 length 140
(9) EAP-Message = 0x010a00521900170303004795fd58cd0de8995f412bfa3ec65c5ab33feb6daa5e9170cfbb5f71d08bd14e92cf2a6c27f6de95d57d7018244bf7c57779fc8590b90f8b073acfb2785950e5911f1d16f1ee0279
(9) Message-Authenticator = 0x00000000000000000000000000000000
(9) State = 0xf2d7523dfbdd4b91d3be03f8478baaed
(9) Finished request
Waking up in 4.9 seconds.
(10) Received Access-Request Id 82 from 172.16.80.241:47107 to 172.16.80.249:1812 length 205
(10) User-Name = "alexis"
(10) NAS-Port-Type = Virtual
(10) Service-Type = Framed-User
(10) NAS-Port = 4
(10) NAS-Port-Id = "branchet"
(10) NAS-IP-Address = 172.16.80.241
(10) Called-Station-Id = "172.16.80.241[4500]"
(10) Calling-Station-Id = "172.16.80.220[4500]"
(10) Acct-Session-Id = "1652882748-4"
(10) EAP-Message = 0x020a00251900170303001a0000000000000003ff88f88c48e6863788fb288fb6b2a9cbb6f6
(10) NAS-Identifier = "strongSwan"
(10) State = 0xf2d7523dfbdd4b91d3be03f8478baaed
(10) Message-Authenticator = 0xa3aa5325adf4b3895f67f2f4a26225be
(10) Restoring &session-state
(10) &session-state:Framed-MTU = 994
(10) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone"
(10) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange"
(10) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec"
(10) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished"
(10) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(10) &session-state:TLS-Session-Version = "TLS 1.2"
(10) # Executing section authorize from file /etc/raddb/sites-enabled/default
(10) authorize {
(10) policy filter_username {
(10) if (&User-Name) {
(10) if (&User-Name) -> TRUE
(10) if (&User-Name) {
(10) if (&User-Name =~ / /) {
(10) if (&User-Name =~ / /) -> FALSE
(10) if (&User-Name =~ /@[^@]@/ ) {
(10) if (&User-Name =~ /@[^@]@/ ) -> FALSE
(10) if (&User-Name =~ /../ ) {
(10) if (&User-Name =~ /../ ) -> FALSE
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) {
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) -> FALSE
(10) if (&User-Name =~ /.$/) {
(10) if (&User-Name =~ /.$/) -> FALSE
(10) if (&User-Name =~ /@./) {
(10) if (&User-Name =~ /@./) -> FALSE
(10) } # if (&User-Name) = notfound
(10) } # policy filter_username = notfound
(10) [preprocess] = ok
(10) [chap] = noop
(10) [mschap] = noop
(10) [digest] = noop
(10) ntdomain: Checking for prefix before ""
(10) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(10) ntdomain: No such realm "NULL"
(10) [ntdomain] = noop
(10) eap: Peer sent EAP Response (code 2) ID 10 length 37
(10) eap: Continuing tunnel setup
(10) [eap] = ok
(10) } # authorize = ok
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) authenticate {
(10) eap: Expiring EAP session with state 0x34242e31352e34e4
(10) eap: Finished EAP session with state 0xf2d7523dfbdd4b91
(10) eap: Previous EAP request found for state 0xf2d7523dfbdd4b91, released from the list
(10) eap: Peer sent packet with method EAP PEAP (25)
(10) eap: Calling submodule eap_peap to process data
(10) eap_peap: (TLS) EAP Done initial handshake
(10) eap_peap: Session established. Decoding tunneled attributes
(10) eap_peap: PEAP state phase2
(10) eap_peap: EAP method MSCHAPv2 (26)
(10) eap_peap: Got tunneled request
(10) eap_peap: EAP-Message = 0x020a00061a03
(10) eap_peap: Setting User-Name to alexis
(10) eap_peap: Sending tunneled request to inner-tunnel
(10) eap_peap: EAP-Message = 0x020a00061a03
(10) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1
(10) eap_peap: User-Name = "alexis"
(10) eap_peap: State = 0x34242e31352e34e42a5abc6d3b098d54
(10) Virtual server inner-tunnel received request
(10) EAP-Message = 0x020a00061a03
(10) FreeRADIUS-Proxied-To = 127.0.0.1
(10) User-Name = "alexis"
(10) State = 0x34242e31352e34e42a5abc6d3b098d54
(10) WARNING: Outer and inner identities are the same. User privacy is compromised.
(10) server inner-tunnel {
(10) session-state: No cached attributes
(10) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel
(10) authorize {
(10) policy filter_username {
(10) if (&User-Name) {
(10) if (&User-Name) -> TRUE
(10) if (&User-Name) {
(10) if (&User-Name =~ / /) {
(10) if (&User-Name =~ / /) -> FALSE
(10) if (&User-Name =~ /@[^@]@/ ) {
(10) if (&User-Name =~ /@[^@]@/ ) -> FALSE
(10) if (&User-Name =~ /../ ) {
(10) if (&User-Name =~ /../ ) -> FALSE
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) {
(10) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) -> FALSE
(10) if (&User-Name =~ /.$/) {
(10) if (&User-Name =~ /.$/) -> FALSE
(10) if (&User-Name =~ /@./) {
(10) if (&User-Name =~ /@./) -> FALSE
(10) } # if (&User-Name) = notfound
(10) } # policy filter_username = notfound
(10) [chap] = noop
(10) [mschap] = noop
(10) ntdomain: Checking for prefix before ""
(10) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(10) ntdomain: No such realm "NULL"
(10) [ntdomain] = noop
(10) update control {
(10) &Proxy-To-Realm := LOCAL
(10) } # update control = noop
(10) eap: Peer sent EAP Response (code 2) ID 10 length 6
(10) eap: No EAP Start, assuming it's an on-going EAP conversation
(10) [eap] = updated
(10) [files] = noop
(10) if (noop && User-Password) {
(10) if (noop && User-Password) -> FALSE
(10) [expiration] = noop
(10) [logintime] = noop
(10) [pap] = noop
(10) } # authorize = updated
(10) Found Auth-Type = eap
(10) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel
(10) authenticate {
(10) eap: Expiring EAP session with state 0x34242e31352e34e4
(10) eap: Finished EAP session with state 0x34242e31352e34e4
(10) eap: Previous EAP request found for state 0x34242e31352e34e4, released from the list
(10) eap: Peer sent packet with method EAP MSCHAPv2 (26)
(10) eap: Calling submodule eap_mschapv2 to process data
(10) eap: Sending EAP Success (code 3) ID 10 length 4
(10) eap: Freeing handler
(10) [eap] = ok
(10) } # authenticate = ok
(10) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel
(10) post-auth {
(10) if (0) {
(10) if (0) -> FALSE
(10) } # post-auth = noop
(10) } # server inner-tunnel
(10) Virtual server sending reply
(10) MS-MPPE-Encryption-Policy = Encryption-Allowed
(10) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(10) MS-MPPE-Send-Key = 0xdb62daaec47aabcf4642e361e93a3b27
(10) MS-MPPE-Recv-Key = 0x2ba20dedf9664d09d8c285c2af92d416
(10) EAP-Message = 0x030a0004
(10) Message-Authenticator = 0x00000000000000000000000000000000
(10) User-Name = "alexis"
(10) eap_peap: Got tunneled reply code 2
(10) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed
(10) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(10) eap_peap: MS-MPPE-Send-Key = 0xdb62daaec47aabcf4642e361e93a3b27
(10) eap_peap: MS-MPPE-Recv-Key = 0x2ba20dedf9664d09d8c285c2af92d416
(10) eap_peap: EAP-Message = 0x030a0004
(10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(10) eap_peap: User-Name = "alexis"
(10) eap_peap: Got tunneled reply RADIUS code 2
(10) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed
(10) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed
(10) eap_peap: MS-MPPE-Send-Key = 0xdb62daaec47aabcf4642e361e93a3b27
(10) eap_peap: MS-MPPE-Recv-Key = 0x2ba20dedf9664d09d8c285c2af92d416
(10) eap_peap: EAP-Message = 0x030a0004
(10) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000
(10) eap_peap: User-Name = "alexis"
(10) eap_peap: Tunneled authentication was successful
(10) eap_peap: SUCCESS
(10) eap: Sending EAP Request (code 1) ID 11 length 46
(10) eap: EAP session adding &reply:State = 0xf2d7523df8dc4b91
(10) [eap] = handled
(10) } # authenticate = handled
(10) Using Post-Auth-Type Challenge
(10) # Executing group from file /etc/raddb/sites-enabled/default
(10) Challenge { ... } # empty sub-section is ignored
(10) session-state: Saving cached attributes
(10) Framed-MTU = 994
(10) TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone"
(10) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange"
(10) TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec"
(10) TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished"
(10) TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(10) TLS-Session-Version = "TLS 1.2"
(10) Sent Access-Challenge Id 82 from 172.16.80.249:1812 to 172.16.80.241:47107 length 104
(10) EAP-Message = 0x010b002e1900170303002395fd58cd0de899608e6219ab90e831a7101766b4c0b7216b7ecdfae9924dbcf672e035
(10) Message-Authenticator = 0x00000000000000000000000000000000
(10) State = 0xf2d7523df8dc4b91d3be03f8478baaed
(10) Finished request
Waking up in 4.9 seconds.
(11) Received Access-Request Id 83 from 172.16.80.241:47107 to 172.16.80.249:1812 length 214
(11) User-Name = "alexis"
(11) NAS-Port-Type = Virtual
(11) Service-Type = Framed-User
(11) NAS-Port = 4
(11) NAS-Port-Id = "branchet"
(11) NAS-IP-Address = 172.16.80.241
(11) Called-Station-Id = "172.16.80.241[4500]"
(11) Calling-Station-Id = "172.16.80.220[4500]"
(11) Acct-Session-Id = "1652882748-4"
(11) EAP-Message = 0x020b002e190017030300230000000000000004ccceff7ae5fffa5e54763197fcf0dd0cfbc3f07673ed7a3e5a3ebf
(11) NAS-Identifier = "strongSwan"
(11) State = 0xf2d7523df8dc4b91d3be03f8478baaed
(11) Message-Authenticator = 0x2a4123557802623c23f40b70a85371a5
(11) Restoring &session-state
(11) &session-state:Framed-MTU = 994
(11) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.3 Handshake, ClientHello"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHello"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Certificate"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerKeyExchange"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, ServerHelloDone"
(11) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, ClientKeyExchange"
(11) &session-state:TLS-Session-Information = "(TLS) recv TLS 1.2 Handshake, Finished"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 ChangeCipherSpec"
(11) &session-state:TLS-Session-Information = "(TLS) send TLS 1.2 Handshake, Finished"
(11) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384"
(11) &session-state:TLS-Session-Version = "TLS 1.2"
(11) # Executing section authorize from file /etc/raddb/sites-enabled/default
(11) authorize {
(11) policy filter_username {
(11) if (&User-Name) {
(11) if (&User-Name) -> TRUE
(11) if (&User-Name) {
(11) if (&User-Name =~ / /) {
(11) if (&User-Name =~ / /) -> FALSE
(11) if (&User-Name =~ /@[^@]@/ ) {
(11) if (&User-Name =~ /@[^@]@/ ) -> FALSE
(11) if (&User-Name =~ /../ ) {
(11) if (&User-Name =~ /../ ) -> FALSE
(11) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) {
(11) if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+).(.+)$/)) -> FALSE
(11) if (&User-Name =~ /.$/) {
(11) if (&User-Name =~ /.$/) -> FALSE
(11) if (&User-Name =~ /@./) {
(11) if (&User-Name =~ /@./) -> FALSE
(11) } # if (&User-Name) = notfound
(11) } # policy filter_username = notfound
(11) [preprocess] = ok
(11) [chap] = noop
(11) [mschap] = noop
(11) [digest] = noop
(11) ntdomain: Checking for prefix before ""
(11) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(11) ntdomain: No such realm "NULL"
(11) [ntdomain] = noop
(11) eap: Peer sent EAP Response (code 2) ID 11 length 46
(11) eap: Continuing tunnel setup
(11) [eap] = ok
(11) } # authorize = ok
(11) Found Auth-Type = eap
(11) # Executing group from file /etc/raddb/sites-enabled/default
(11) authenticate {
(11) eap: Expiring EAP session with state 0xf2d7523df8dc4b91
(11) eap: Finished EAP session with state 0xf2d7523df8dc4b91
(11) eap: Previous EAP request found for state 0xf2d7523df8dc4b91, released from the list
(11) eap: Peer sent packet with method EAP PEAP (25)
(11) eap: Calling submodule eap_peap to process data
(11) eap_peap: (TLS) EAP Done initial handshake
(11) eap_peap: Session established. Decoding tunneled attributes
(11) eap_peap: PEAP state send tlv success
(11) eap_peap: Received EAP-TLV response
(11) eap_peap: Success
(11) eap: Sending EAP Success (code 3) ID 11 length 4
(11) eap: Freeing handler
(11) [eap] = ok
(11) } # authenticate = ok
(11) # Executing section post-auth from file /etc/raddb/sites-enabled/default
(11) post-auth {
(11) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) {
(11) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE
(11) update {
(11) &reply::Framed-MTU += &session-state:Framed-MTU[] -> 994
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) recv TLS 1.3 Handshake, ClientHello'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 Handshake, ServerHello'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 Handshake, Certificate'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 Handshake, ServerKeyExchange'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 Handshake, ServerHelloDone'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) recv TLS 1.2 Handshake, ClientKeyExchange'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) recv TLS 1.2 Handshake, Finished'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 ChangeCipherSpec'
(11) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[] -> '(TLS) send TLS 1.2 Handshake, Finished'
(11) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[] -> 'ECDHE-RSA-AES256-GCM-SHA384'
(11) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[] -> 'TLS 1.2'
(11) } # update = noop
(11) [exec] = noop
(11) policy remove_reply_message_if_eap {
(11) if (&reply:EAP-Message && &reply:Reply-Message) {
(11) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE
(11) else {
(11) [noop] = noop
(11) } # else = noop
(11) } # policy remove_reply_message_if_eap = noop
(11) } # post-auth = noop
(11) Sent Access-Accept Id 83 from 172.16.80.249:1812 to 172.16.80.241:47107 length 174
(11) MS-MPPE-Recv-Key = 0xbc0b4380128e4f507962d56365e9a2df9f3a5a5367d8a350ab7f1a1708055d0b
(11) MS-MPPE-Send-Key = 0xc4e5ffa919ef79357191aaa43b08e20b64e3b32470b19b0b73ef669b8b42713d
(11) EAP-Message = 0x030b0004
(11) Message-Authenticator = 0x00000000000000000000000000000000
(11) User-Name = "alexis"
(11) Framed-MTU += 994
(11) Finished request
Waking up in 4.9 seconds.
(12) Received Accounting-Request Id 84 from 172.16.80.241:37621 to 172.16.80.249:1813 length 136
(12) Acct-Status-Type = Start
(12) Acct-Session-Id = "1652882748-4"
(12) NAS-Port-Type = Virtual
(12) Service-Type = Framed-User
(12) NAS-Port = 4
(12) NAS-Port-Id = "branchet"
(12) NAS-IP-Address = 172.16.80.241
(12) Called-Station-Id = "172.16.80.241[4500]"
(12) Calling-Station-Id = "172.16.80.220[4500]"
(12) User-Name = "alexis"
(12) NAS-Identifier = "strongSwan"
(12) # Executing section preacct from file /etc/raddb/sites-enabled/default
(12) preacct {
(12) [preprocess] = ok
(12) policy acct_unique {
(12) update request {
(12) &Tmp-String-9 := "ai:"
(12) } # update request = noop
(12) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {
(12) EXPAND %{hex:&Class}
(12) -->
(12) EXPAND ^%{hex:&Tmp-String-9}
(12) --> ^61693a
(12) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE
(12) else {
(12) update request {
(12) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(12) --> c04befc8cc4f6cb589532ffc644691b7
(12) &Acct-Unique-Session-Id := c04befc8cc4f6cb589532ffc644691b7
(12) } # update request = noop
(12) } # else = noop
(12) } # policy acct_unique = noop
(12) ntdomain: Checking for prefix before ""
(12) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(12) ntdomain: No such realm "NULL"
(12) [ntdomain] = noop
(12) [files] = noop
(12) } # preacct = ok
(12) # Executing section accounting from file /etc/raddb/sites-enabled/default
(12) accounting {
(12) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
(12) detail: --> /var/log/radius/radacct/172.16.80.241/detail-20220518
(12) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.80.241/detail-20220518
(12) detail: EXPAND %t
(12) detail: --> Wed May 18 16:16:47 2022
(12) [detail] = ok
(12) [unix] = ok
(12) [exec] = noop
(12) attr_filter.accounting_response: EXPAND %{User-Name}
(12) attr_filter.accounting_response: --> alexis
(12) attr_filter.accounting_response: Matched entry DEFAULT at line 12
(12) [attr_filter.accounting_response] = updated
(12) } # accounting = updated
(12) Sent Accounting-Response Id 84 from 172.16.80.249:1813 to 172.16.80.241:37621 length 20
(12) Finished request
(12) Cleaning up request packet ID 84 with timestamp +3
Waking up in 4.9 seconds.
(13) Received Accounting-Request Id 85 from 172.16.80.241:37621 to 172.16.80.249:1813 length 172
(13) Acct-Status-Type = Stop
(13) Acct-Session-Id = "1652882748-4"
(13) NAS-Port-Type = Virtual
(13) Service-Type = Framed-User
(13) NAS-Port = 4
(13) NAS-Port-Id = "branchet"
(13) NAS-IP-Address = 172.16.80.241
(13) Called-Station-Id = "172.16.80.241[4500]"
(13) Calling-Station-Id = "172.16.80.220[4500]"
(13) User-Name = "alexis"
(13) Acct-Output-Octets = 0
(13) Acct-Output-Packets = 0
(13) Acct-Input-Octets = 0
(13) Acct-Input-Packets = 0
(13) Acct-Session-Time = 0
(13) Acct-Terminate-Cause = User-Request
(13) NAS-Identifier = "strongSwan"
(13) # Executing section preacct from file /etc/raddb/sites-enabled/default
(13) preacct {
(13) [preprocess] = ok
(13) policy acct_unique {
(13) update request {
(13) &Tmp-String-9 := "ai:"
(13) } # update request = noop
(13) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) {
(13) EXPAND %{hex:&Class}
(13) -->
(13) EXPAND ^%{hex:&Tmp-String-9}
(13) --> ^61693a
(13) if (("%{hex:&Class}" =~ /^%{hex:&Tmp-String-9}/) && ("%{string:&Class}" =~ /^ai:([0-9a-f]{32})/i)) -> FALSE
(13) else {
(13) update request {
(13) EXPAND %{md5:%{User-Name},%{Acct-Session-ID},%{%{NAS-IPv6-Address}:-%{NAS-IP-Address}},%{NAS-Identifier},%{NAS-Port-ID},%{NAS-Port}}
(13) --> c04befc8cc4f6cb589532ffc644691b7
(13) &Acct-Unique-Session-Id := c04befc8cc4f6cb589532ffc644691b7
(13) } # update request = noop
(13) } # else = noop
(13) } # policy acct_unique = noop
(13) ntdomain: Checking for prefix before ""
(13) ntdomain: No '' in User-Name = "alexis", looking up realm NULL
(13) ntdomain: No such realm "NULL"
(13) [ntdomain] = noop
(13) [files] = noop
(13) } # preacct = ok
(13) # Executing section accounting from file /etc/raddb/sites-enabled/default
(13) accounting {
(13) detail: EXPAND /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d
(13) detail: --> /var/log/radius/radacct/172.16.80.241/detail-20220518
(13) detail: /var/log/radius/radacct/%{%{Packet-Src-IP-Address}:-%{Packet-Src-IPv6-Address}}/detail-%Y%m%d expands to /var/log/radius/radacct/172.16.80.241/detail-20220518
(13) detail: EXPAND %t
(13) detail: --> Wed May 18 16:16:47 2022
(13) [detail] = ok
(13) [unix] = ok
(13) [exec] = noop
(13) attr_filter.accounting_response: EXPAND %{User-Name}
(13) attr_filter.accounting_response: --> alexis
(13) attr_filter.accounting_response: Matched entry DEFAULT at line 12
(13) [attr_filter.accounting_response] = updated
(13) } # accounting = updated
(13) Sent Accounting-Response Id 85 from 172.16.80.249:1813 to 172.16.80.241:37621 length 20
(13) Finished request
(13) Cleaning up request packet ID 85 with timestamp +3
Waking up in 4.9 seconds.

mschap :
mschap {
use_mppe = yes
with_ntdomain_hack = yes
ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --allow-mschapv2 --username=%{mschap:User-Name} --domain=VPNLINKSO --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}"
pool {
start = ${thread[pool].start_servers}
min = ${thread[pool].min_spare_servers}
max = ${thread[pool].max_servers}
spare = ${thread[pool].max_spare_servers}
uses = 0
retry_delay = 30
lifetime = 86400
cleanup_interval = 300
idle_timeout = 600
}
passchange {
}
}

ipsec.conf :

config setup
strictcrlpolicy=yes
uniqueids=never
conn branchet
auto=add
compress=no
type=tunnel
keyexchange=ikev2
fragmentation=yes
forceencaps=yes

ike=aes256-sha1-modp1024,aes256gcm16-sha256-ecp521,aes256-sha256-ecp384,aes256-sha384-prfsha384-ecp384!
esp=aes256-sha1,aes128-sha256-modp3072,aes256gcm16-sha256,aes256gcm16-ecp384,aes256!

dpdaction=clear
dpddelay=180s
rekey=no
left=%any
leftid=172.16.80.241
leftcert=server-cert.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-radius # this uses radius authentication
eap_identity=%any
rightdns=8.8.8.8,8.8.4.4
rightsourceip=10.10.10.0/24
rightsendcert=never

The user vpn configuration :
Set-VpnConnectionIPsecConfiguration -ConnectionName "VPN” -AuthenticationTransformConstants None -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA384 -PfsGroup None -DHGroup ECP384 -PassThru -Force

Thanks in advance for any tips or lead, have a wonderful day.

Answered by Nelse74

May 18, 2022

Update :

It works after moving to another windows virtual machine. a new one.
I put it in the domain and the connection works on other users too.

Well, hope it will not occur on the real computers.

View full answer

Nelse74 · 2022-05-18T16:11:54Z

Nelse74
May 18, 2022
Author

Update :

It works after moving to another windows virtual machine. a new one.
I put it in the domain and the connection works on other users too.

Well, hope it will not occur on the real computers.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

invalid payload received #1054

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

invalid payload received #1054

Uh oh!

Uh oh!

Nelse74 May 18, 2022

Replies: 1 comment

Uh oh!

Nelse74 May 18, 2022 Author

Nelse74
May 18, 2022

Nelse74
May 18, 2022
Author