Hi, Any help with using the pt-tls-client and tnc-pdp plugin in a usable situation would be greatly appreciated.
I am using StrongSwan through a Cisco ASA like the following and I wish to use it to perform remote attestation: Inside network --- StrongSwan gateway ====192.168.0.0/24==== ASA ==== 192.168.1.0/24==== Device I have configured the StrongSwan connection between the device and the ASA, such that connecting out to the device from the inside network will automatically bring up the StrongSwan tunnel between the device and ASA and the connection established. IKE traffic is exempt from the negotiated tunnel (preventing nested tunnels) and then blocked by the ASA. This prevents me from then setting up another connection from the gateway to the device using EAP-TTLS with remote attestation and an allow / isolate behaviour (like that of this example https://wiki.strongswan.org/projects/strongswan/wiki/IMA). The only way I have been able to get attesation measurements from the device to the gateway is by using the PT-TLS protocol with the pt-tls-client on the device and the tnc-pdp plugin listening on the PT-TLS TCP port 271 of the StrongSwan gateway. This goes through the negtioated tunnel between the device and the ASA with no issues. At present I am running the pt-tls-client command on the device but I have two problems: - The device (pt-tls-client command) needs to have knowledge of the IP address of the StrongSwan gateway. - The result will then appear in the attesation database on the StrongSwan gateway but a decision will not be made to allow or isolate the device. I can not see how this can be used when connecting out to a device from the inside network, then perform attesatation to allow or block the connection based upon the measurements. Is this kind of thing possible? How can I get attestation to occur using the PT-TLS Protocol when connecting to the device from the inside network where the device doesn't have knowledge of the StrongSwan gateway's IP address? I hope this is clear, I am happy to provide more information. Kind regards, Mario
