IKEv2 and Active Directory
-
Thanks so much for this ibauersachs
I've successfully applied the patch on top of 2.2.1, and I can see the EAP-RADIUS option and pre-shared key fields. I hope to find some time later today to test if this works for us - I'll post back the results as soon as I can
Thanks again!
Peter -
This should work already in pfSense.
An external script is executed to perform authentication by pfSense tools.Granted accounting is still not implemented by that.
I will analyse the pull request as well also noted on redmine https://redmine.pfsense.org/issues/4614
can you submit a pull request for this and sign the contributor agreement?
Mention the redmine in your pull request. -
I couldn't get RADIUS to work with the external script and the Windows IKEv2 client. As far as I can tell this cannot work because the script relies on the cleartext username/password, which Windows doesn't provide with the MSCHAP authentication.
Pull requests:
Master: https://github.com/pfsense/pfsense/pull/1612
RelEng 2.2: https://github.com/pfsense/pfsense/pull/1613(Those are rebased on today's commits, so the commit-links of my previous post are no longer valid)
I've already signed the CLA.
-
Can you add in "secondary" radius server support, not just "primary". It would be great to have redundancy in case an NPS server has to be taken down for maintenance. Thanks.
-
It normally should allow for multi selection like all other places.
-
@ermal:
It normally should allow for multi selection like all other places.
It allows you to select multiple radius servers in mobile clients tab. Problem is that it doesn't actually properly write strongSwan.conf then. Instead of properly populating the radius attr section with primary and secondary, it sticks their names into x-auth generic which will not work.
-
@ermal:
It normally should allow for multi selection like all other places.
It allows you to select multiple radius servers in mobile clients tab. Problem is that it doesn't actually properly write strongSwan.conf then. Instead of properly populating the radius attr section with primary and secondary, it sticks their names into x-auth generic which will not work.
This should be fixed on 2.3, it didn't make 2.2.5.
-
@ermal:
It normally should allow for multi selection like all other places.
It allows you to select multiple radius servers in mobile clients tab. Problem is that it doesn't actually properly write strongSwan.conf then. Instead of properly populating the radius attr section with primary and secondary, it sticks their names into x-auth generic which will not work.
This should be fixed on 2.3, it didn't make 2.2.5.
I now see that it was fixed, the issue didn't mention the multiple server problem though:
https://redmine.pfsense.org/issues/5219
https://redmine.pfsense.org/projects/pfsense/repository/revisions/6684d5944eacf4dbd717edba9d82c30001b5bc3b/diff/src/etc/inc/vpn.incAre there any plans to support "preference" of these servers? Thanks.
-
Not currently, though if you make sure to add the one you want to prefer to the user manager servers first it would be preferred. It will go from the top down the list.
-
Not currently, though if you make sure to add the one you want to prefer to the user manager servers first it would be preferred. It will go from the top down the list.
Didn't know that, if that's the case that's good enough.
-
@lctech Allowing to select multiple servers for your use case (load balancing, high availability) could be easily implemented because strongSwan can do that already. I opted against allowing multi-selection in April because in my understanding multiple defined servers would mean asking each of them in turn, which is what the xauth-generic script does. So the selection there would have been ambiguous.
