|
Hi Martin
correctHi Hans,I added multiple certificates OU=<groupname> to the cert store, hoping that Windows would ask me which one to use, with no luck.I assume you are using Machine Certificates to authenticate the clients? I'm not aware of a way to enforce a specific certificate in IKE authentication. If I recall correctly, with "use simple certificate selection" set, Windows is simply narrowing down the list of possible certificates for selection, I guess based on the DN of the remote cert.What you might try is to switch from Machine Certificates to EAP-TLS authentication (in IKEv2). Microsoft uses EAP-TLS to authenticate users (not the Machine) with certificates or Smartcards. When selecting "Smart Card or certificate" as EAP method, you can even (un-)set a "Use simple certificate selection" flag that sounds promising. I've tried what you suggested with the following ipsec.conf entries: conn %default keyingtries=1 ikelifetime=60m keylife=20m rekeymargin=3m keyexchange=ikev2 compress=yes dpddelay=30 dpdtimeout=120 dpdaction=clear mobike=no esp=aes256-sha1-modp4096! ike=aes256-sha512-modp4096! conn dev rightsourceip=172.30.131.127/25 eap_identity=dev-oti.dom.ch also=warriors conn test rightsourceip=172.30.131.127/25 eap_identity=test-oti.dom.ch also=warriors conn warriors left=%defaultroute leftcert=oti-vpn.dom.ch.crt [email protected] leftsubnet=0.0.0.0/0 leftfirewall=yes right=%any #rightdns= esp=aes256-sha1! ike=aes256-sha2_384-modp1024! dpddelay=300s rekey=no mobike=yes auto=add rightsendcert=never rightauth=eap-tls However I could not convince strongswan to select the connection based on the TLS certficate ... Oct 27 15:43:42 oti-5700 charon: 13[CFG] looking for peer configs matching 172.30.131.20[%any]...192.168.3.70[192.168.3.70] Oct 27 15:43:42 oti-5700 charon: 13[CFG] candidate "dev", match: 1/1/6 (me/other/ike) Oct 27 15:43:42 oti-5700 charon: 13[CFG] candidate "test", match: 1/1/6 (me/other/ike) Oct 27 15:43:42 oti-5700 charon: 13[CFG] selected peer config 'dev' Oct 27 15:43:42 oti-5700 charon: 13[IKE] using configured EAP-Identity dev-oti.zal.io ... selecting the dev-oti.dom.ch cert on the windows side brought up the connection. Selecting test-oti.dom.ch failed due to strongswan always using peer 'dev' (the first one) and the eap_identity missmatching. Looks like the peer config is selected before the eap-tls comes into play. Am I missing something here? Regards Hans AND I'm impressed by the work and support you guys provide, thank's a lot! -- Hans Riethmann ortecin GmbH Waffenplatzstrasse 40, 8002 Zuerich mobile: +41 79 689 1052, phone: +41 44 280 2828 |
<<attachment: hans_riethmann.vcf>>
_______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
