Project

General

Profile

Actions
Copy link

Regression #11447

closed
JP JP

EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes

Regression #11447: EAP-RADIUS Mobile IPsec clients with RADIUS-assigned addresses do not get additional configuration attributes

Added by Jim Pingle over 5 years ago. Updated over 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jim Pingle
Category:
IPsec
Target version:
2.6.0
Start date:
02/18/2021
Due date:
% Done:

100%

Estimated time:
Plus Target Version:
22.01
Release Notes:
Default
Affected Version:
2.5.0
Affected Architecture:

Description

When using IKEv2 EAP-RADIUS mobile IPsec and assigning client addresses from RADIUS, the pools configuration is omitted from swanctl.conf.

The pools and mobile-pool blocks are omitted since there are no addresses known for clients. The RADIUS config is in strongswan.conf

May still need to still define the pools without addresses (if possible) or find other compatible syntax.

Related issues 1 (0 open — 1 closed)

Related to Bug #11891: strongSwan configuration contains incorrect structure for mobile pool DNS recordsResolvedJim Pingle05/05/2021

Actions

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #1

  • Assignee set to Jim Pingle

As a workaround, define a pool network. Clients will still pull their assigned addresses from RADIUS and the other settings will be populated in the configuration and make it to clients.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #3

  • Status changed from New to Pull Request Review

RB Updated by Renato Botelho over 5 years ago Actions
Copy link
 #4

  • Status changed from Pull Request Review to Feedback

PR has been merged. Thanks!

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #5

  • Status changed from Feedback to Waiting on Merge
  • Target version changed from CE-Next to 2.5.1

RB Updated by Renato Botelho over 5 years ago Actions
Copy link
 #6

  • Status changed from Waiting on Merge to Feedback

Cherry-picked to RELENG_2_5_1

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #7

To test:

  • Setup mobile IPsec using IKEv2 and EAP-RADIUS against a RADIUS server
  • Leave the Virtual Address Pool empty so that clients pull addresses from RADIUS
  • Fill in DNS server information
  • Check the generated swanctl.conf for the configured DNS servers and they will be missing

On a snapshot with the fix, the swanctl.conf file will contain the necessary pool configuration data.

VG Updated by Viktor Gurov over 5 years ago Actions
Copy link
 #8

Jim Pingle wrote:

To test:

  • Setup mobile IPsec using IKEv2 and EAP-RADIUS against a RADIUS server
  • Leave the Virtual Address Pool empty so that clients pull addresses from RADIUS
  • Fill in DNS server information
  • Check the generated swanctl.conf for the configured DNS servers and they will be missing

On a snapshot with the fix, the swanctl.conf file will contain the necessary pool configuration data.

Still not working as expected.
It looks like we need to use strongswan.conf for this (pre-2.5 style).

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #9

  • Target version changed from 2.5.1 to CE-Next

If it needs that kind of more involved work then we can look at it deeper for the next release after this.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #10

  • Target version changed from CE-Next to 2.6.0

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #11

  • Plus Target Version set to 21.05

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #12

Already in 21.05 branch.

JP Updated by Jim Pingle over 5 years ago Actions
Copy link
 #13

  • Status changed from Feedback to New
  • Plus Target Version changed from 21.05 to 21.09

Reverted changes for now, they were causing the configuration to fail. Can try again before the next release.

VG Updated by Viktor Gurov about 5 years ago Actions
Copy link
 #14

revert to pre-2.5 style (attr in strongswan.conf) which works fine:
https://gitlab.netgate.com/pfSense/pfSense/-/merge_requests/314

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #15

  • Status changed from New to Pull Request Review

JP Updated by Jim Pingle about 5 years ago Actions
Copy link
 #16

  • Related to Bug #11891: strongSwan configuration contains incorrect structure for mobile pool DNS records added

Updated by Anonymous about 5 years ago Actions
Copy link
 #17

  • Status changed from Pull Request Review to Feedback
  • % Done changed from 0 to 100

Applied in changeset commit:3a0f6f3609dcb50e3ba927a743fb9f1990a48181.

JP Updated by Jim Pingle almost 5 years ago Actions
Copy link
 #18

  • Plus Target Version changed from 21.09 to 22.01

PR Updated by Pedro Ribeiro almost 5 years ago Actions
Copy link
 #19

I recently hit this bug where IKEv2 EAP-RADIUS clients were not getting their DNS server.

Apologies for the comment, but in case it helps anyone, a helpful workaround is to pass parameters from FreeRADIUS for the affected users, eg. for DNS server in Additional RADIUS Attributes (REPLY-ITEM) insert MS-Primary-DNS-Server = x.x.x.x. This matches well with the docs at https://wiki.strongswan.org/projects/strongswan/wiki/EAPRADIUS.

JP Updated by Jim Pingle over 4 years ago Actions
Copy link
 #20

  • Status changed from Feedback to Closed
Actions
Copy link

Also available in: Atom