1

There are a million site-to-site and host-to-host examples. I can't seem to find a single site-to-host example. I am looking for the most basic possible example with no certificates at all, that just listens and accepts with a simple username and password from any ipaddress, one that will work with the built-in windows client.

EDIT: When I try the roadwarrior examples it just says my username or password is incorrect in windows

/etc/ipsec.secrets:

: PSK "mypassword"

/etc/ipsec.conf:

conn rw
    leftsubnet=192.168.0.0/16
    leftcert=moonCert.pem
    right=%any
    authby=psk
    auto=add

I get the following error

12[IKE] peer requested EAP, config unacceptable
12[CFG] no alternative config found
12[IKE] peer supports MOBIKE
12[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]

when I try to connect in windows and just provide the password with no username.

Any thoughts on how to correct the authentication issue?

Edit 2:

With the following config 
leftsubnet=x.x.0.0/16
left=x.x.x.x
right=%any
leftauth=pubkey
rightauth=eap-mschapv2
eap_identity=%identity
auto=add

and ipsec.secrets

user : EAP "password"

I get the following error

[CFG] selected peer config 'rw'
[IKE] initiating EAP_IDENTITY method (id 0x00)
[IKE] peer supports MOBIKE
[IKE] no private key found for '192.168.254.137'
[ENC] generating IKE_AUTH response 1 [ N(AUTH_FAILED) ]
5
  • You're joking, right? I mean, you really haven't found any of the many, many remote-access (roadwarrior) example configs?
    – ecdsa
    May 26 at 7:04
  • ahh ok I didn't realize those were site to host, I thought those were host to host. when I try all of those windows just says my username or password is incorrect
    – noone392
    May 26 at 7:20
  • Site-to-site fully applies to your question. No jokes.
    – drookie
    May 26 at 9:33
  • You configured authby=psk. What you want instead is rightauth=eap-mschapv2 and leftauth=pubkey. Windows also requires eap_identity=%identity.
    – ecdsa
    May 26 at 10:17
  • updated config per your segestion added to edits. Looks like it made it a lot further. I am trying to avoid actually generating a key pair that I have to share with the client so this can remain simple. I don't care about security at all for this particular use case
    – noone392
    May 26 at 13:33

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Browse other questions tagged or ask your own question.