IPsec v2 - EAP-TLS Support

hege

@ermal:

I just pushed the first implementation for EAP-TLS.
Though please do testing and see if anything can be fixed or made working.

Thank you!

It seems that there is a lot more work needed for get this working.

With original config by pfsense

Sep 13 14:55:08 	charon: 11[IKE] configured EAP-only authentication, but peer does not support it
Sep 13 14:55:08 	charon: 11[IKE] <con1|11> configured EAP-only authentication, but peer does not support it</con1|11>

With customized config
leftauth = pubkey
rightauth = eap-tls

Sep 13 14:56:57 	charon: 11[TLS] sending fatal TLS alert 'certificate unknown'
Sep 13 14:56:57 	charon: 11[TLS] no trusted certificate found for '(ClientLanIP)' to verify TLS peer
Sep 13 14:56:57 	charon: 11[TLS] received TLS peer certificate 'C=AT, ST=Austria, L=XXXX, O=XXXXX, OU=XXXXXX, CN=(PCName), E=XXXXXX'

With customized config2
leftauth = pubkey
rightauth = eap-tls
eap_identity = "C=AT, ST=Austria, L=XXXX, O=XXXXX, OU=XXXXXX, CN=(PCName), E=XXXXXX"

With above changes in the config, i can connect with WP8 and Win8, but there is no traffic throughput - FW Rules are ok.
Same issue here?: https://forum.pfsense.org/index.php?topic=80300.0

Sep 13 15:00:13 	charon: 11[IKE] CHILD_SA con1{1} established with SPIs c11f9fdf_i 7d19592a_o and TS (pfSenseLANNET)/24|/0 === 10.11.12.0/24|/0
Sep 13 15:00:13 	charon: 11[IKE] <con1|13> CHILD_SA con1{1} established with SPIs c11f9fdf_i 7d19592a_o and TS (pfSenseLANNET)/24|/0 === 10.11.12.0/24|/0
..
Sep 13 15:00:13 	charon: 11[IKE] <con1|13> assigning virtual IP 10.11.12.1 to peer 'C=AT, ST=Austria, L=XXXX, O=XXXXX, OU=XXXXXX, CN=(PCName), E=XXXXXX'
Sep 13 15:00:13 	charon: 11[CFG] reassigning offline lease to 'C=AT, ST=Austria, L=XXXX, O=XXXXX, OU=XXXXXX, CN=(PCName), E=XXXXXX'
Sep 13 15:00:13 	charon: 11[IKE] peer requested virtual IP %any
..
Sep 13 15:00:13 	charon: 11[IKE] authentication of '(ClientLanIP)' with EAP successful
Sep 13 15:00:13 	charon: 11[IKE] <con1|13> authentication of '(ClientLanIP)' with EAP successful
..
Sep 13 15:00:13 	charon: 11[IKE] EAP method EAP_TLS succeeded, MSK established
Sep 13 15:00:13 	charon: 11[IKE] <con1|13> EAP method EAP_TLS succeeded, MSK established</con1|13></con1|13></con1|13></con1|13>

IPv4 Routes: (seems wrong for me)

10.11.12.0/24 	(pfSense-WAN-GW) 	US 	0 	1500 	hn0

IPsec Overview:

IPsecOverview.png_thumb

Raul Ramos

Hi

Can i use PEAP-MSCHAPv2 now? or have to be in config to? I see EAP-TLS but not PEAP-MSCHAPv2. I can't connect even less pass traffic.

@hege what are your config on pfsense phase 1,2, mobile in Algorithms and proposal? have you information of this on a MS Site i see in one place this information, i can't find it.

Thanks

hege

No, that requires a different config.

Edit:

Required Config:
leftauth=pubkey
rightauth=eap-mschapv2
eap_identity=%any

and secret in ipsec.secrets:
user@domain.loc : EAP "password"

ipsec rereadall
ipsec reload

just tested it with WP8 + Win8, but still no traffic throughput

Raul Ramos

I will play with certs and try EAP-TLS but have you the Algorithms proposal and hashes compatible with WP8.1?

Thanks

hege

@mais_um:

..have you the Algorithms proposal and hashes compatible with WP8.1?

You can find the available proposals in the log files (with higher loglevel)
I use this one: (Windows 8 and WP8)

Phase1:
AES 256
SHA 256
DH2

Phase2:
AES 256
SHA1
PFS 2

eri--

@hepe,

i used a config from strongswan samples for eap-tls.
Though i will see to allow specifying different left and right auth.

hege

@ermal:

i used a config from strongswan samples for eap-tls.

This one?
https://wiki.strongswan.org/projects/strongswan/wiki/EapTls

By default, the Gateway uses IKEv2 certificate authentication to prove its identity to the clients. But as EAP-TLS is a mutual authentication protocol, EAP-only authentication can be used by specifying leftauth=eap.

As far as I understand it's possible to use eap-tls on the gateway, but usually it's pubkey.

kathode

Hi there,

I'm relatively new to pfSense. I have managed to get MSCHAP-v2 with IPSec working on Windows Phone 8.1 Update 1 by editing the files mentioned in this topic. I have been running pfSense 2.2 RC for a while now, so I was just wondering whether this kind of configuration will be implemented directly by pfSense, seeing as it is possible by the underlying software? If not, is there any way to prevent the configuration files from being auto re-generated by pfSense?

hege

Hi,

I just created a bounty for eap-tls.

https://forum.pfsense.org/index.php?topic=86727.0

@kathode
I think an implementation of mschap-v2 will be a lot of work, because it requires a different format in ipsec.secrets.

eri--

kathode can you explain how you did so i can give a look to integrate in master branch?

hege

@hege:

Required Config:
leftauth=pubkey
rightauth=eap-mschapv2
eap_identity=%any

and secret in ipsec.secrets:
user@domain.loc : EAP "password"

ipsec rereadall
ipsec reload

eri--

Can you post the full ipsec.conf?

hege

Sorry, this ok?


conn con1
        aggressive = yes
        fragmentation = yes
        keyexchange = ikev2
        reauth = no
        rekey = no
        reqid = 1
        installpolicy = yes
        type = tunnel
        dpdaction = clear
        dpddelay = 10s
        dpdtimeout = 60s
        auto = add
        left = My WAN IP
        right = %any
        leftid = my.cert.CN
        ikelifetime = 28800s
        lifetime = 3600s
        rightsourceip = 10.12.34.0/24
        rightsubnet = 10.12.34.0/24
        leftsubnet = My LAN NET/24
        ike = aes256-sha256-modp1024!
        esp = aes256-sha1-modp1024,aes192-sha1-modp1024,aes128-sha1-modp1024,aes128gcm128-sha1-modp1024,aes128gcm96-sha1-modp
1024,aes128gcm64-sha1-modp1024,aes192gcm128-sha1-modp1024,aes192gcm96-sha1-modp1024,aes192gcm64-sha1-modp1024,aes256gcm128-sh
a1-modp1024,aes256gcm96-sha1-modp1024,aes256gcm64-sha1-modp1024!
        leftauth=pubkey
        rightauth=eap-mschapv2
        leftcert=/var/etc/ipsec/ipsec.d/certs/cert-1.crt
        eap_identity=%any

and in ipsec.secrets:
user@domain.loc : EAP "password"

I modified the config, generated by your eap-tls implementation.

eri--

Ok this is merged on to master branch.
You have a config option to configure EAP-MSchapv2 and it will generate this config.
The preshared-keys entries can be specified the type PSK/EAP now.

You can either use the patch with the patch package or gitsync to master since at this times the differences are not huge with 2.2

hege

Sorry I forgot one important thing:

The link to the private key has to be in ipsec.secrets (not only eap-mschapv2)
" : RSA /var/etc/ipsec/ipsec.d/private/cert-3.key"

(space at start)
https://wiki.strongswan.org/projects/strongswan/wiki/RsaSecret

I applied your patch, added the RSA key to the ipsec.secrets, and used this commands:
ipsec rereadall
ipsec reload

eap-mschapv2 WORKING on Win 8.1 Pro and Windows Phone 8.1!
Config:
Phase1: AES256/SHA1/DH2
Phase2: AES256/SHA1/PFS

eri--

That is already done according to me though i will double check.

Done it was just forgotten.
Test it and let me know.

eri--

FYI,

this has been merged into 2.2 as well.

hege

I just made a fresh test. (Windows Phone 8.1 / Windows 8.1 Pro / Windows 7 Pro)
Everything is working fine with mschap

I would say, eap-mschapv2 is now fully implemented, working and tested.

Needed Win 8 Client config:

Security: IKEv2
Data encryption: Require encryption
Authentication
Use EAP Microsoft: Secured password (EAP-MSCHAP v2)

The pfSense vpn cert need at least this EKU: 1.3.6.1.5.5.7.3.1
Also the vpn cert used by pfSense has to be accepted by the Win 8 machine (full trust of chain)

@kathode I think you have to say "Thank you ermal!" :D

jimp

@hege:

The pfSense vpn cert need at least this EKU: 1.3.6.1.5.5.7.3.1

To confirm/clarify, that EKU is "TLS Web server authentication" which is added to the cert when "Server Certificate" is chosen in the pfSense GUI.

wta

First of all, thank you ermal and everyone else who contributed to this! Lack of EAP-MSCHAPv2 support has been preventing me to connect to my pfSense from my Windows Phone 8.1 phone but not any more.

I struggled hours to get this to work. So that no one else does the same mistakes, here are everything I did wrong. First, I accidently used an old certificate generated - I believe for OpenVPN - a long time ago. Problem with this one was that it was a client certificate so it didn't include the needed EKU. After generating a proper server cert (and with my pfSense box DynDNS name in Alternate Names) I finally managed to get IPSec to work with my Android tablet using strongSwan client.

At this point my WP8.1 phone nor Windows 8 PC still didn't want to connect. This time the problem was that although I had installed the server cert so that Win8/WP8 would trust it, I hadn't installed CA root cert which is also required, as stated in http://technet.microsoft.com/en-us/library/dd941612%28v=ws.10%29.aspx. After installing the root cert in the Trusted Root Certification Authorities per-computer certificate store (very important it's exactly this one) Win8 PC finally connected.

With WP8 I stumbled a small problem, though. Whereas Win8 PC reports the configured identifier properly (let's call it user), my Lumia prefixes it with Windows Phone so pfSense sees it as Windows Phone\user. This would require identifier to be in ipsec.secrets as in "Windows Phone\user" : EAP password. However, pfSense GUI doesn't allow spaces, backslashes or quotation marks to be included in identifiers. If I manually add the above line in ipsec.secrets and reload it, connection works also with WP8. Configuration is overwritten quite often automatically, though, so this workaroung doesn't work for very long.

Would it be difficult to make the inclusion of _Windows Phone_ possible in key identifiers? Or is there another way to do this?

Again, thank you everyone who has been involved in this!