Accounting IPSec connections with RSA authentication

Question

Apple iOS has "VPN On Demand" function. With this function the VPN connection is made whenever the device tries to connect to certain domains or to the internet at all. iOS supports "VPN On Demand" only with certificated-based authentication.

To provide "VPN On Demand" for iOS users of my office VPN server we are using next IPSec solution:

• Ubuntu 14.04 - the VPN server OS.
• strongSwan 5.1.2 - IKE daemon.
• For each peer I am generating an individual private key and issue a matching certificate. Client (iOS IKEv1) authenticates using RSA and Xauth.
• iPhone and iPad can't use IPSec without Xauth (so-called Cisco IPSec). And "VPN On Demand" can't use VPN profile which requires password entering, but username/password usually are required by Xauth. To handle this problem we are using xauth-noauth - fake Xauth authenticator which allows any username and password. In this case we are using only client certificate to authenticate it.

This solution is working fine for us. But we got new requirement - setup several VPN servers with one users database and make accounting of the VPN usage.

This is a common practice for this task to use RADIUS and strongSwan has plugin for it. But strongSwan with IKEv1/Xauth uses username/password for authenticating user on the backend RADIUS server. username/password is not using in my solution.

My questions:

1. How to use Radius accounting if Xauth is not using username/password?
2. Is it possible to delegate RSA authentication check to RADIUS server?

P.S. Most of my iOS clients use iOS 8 which supports IKEv2. There is EAP-TLS in IKEv2. Can I use EAP-TLS to delegate RSA authentication check to RADIUS server? Or I am digging in the wrong direction with EAP-TLS?

P.S. P.S. My second thing was about VICI interface of strongSwan. I supposed to get notifications about each new IPSec connection, but looks like VICI works different way.

Answer 1

RADIUS Accounting in the eap-radius plugin does not require XAuth authentication. It actually works with any kind of authentication, via RADIUS or not, as long as the client requests a virtual IP address (for IKEv2 even this requirement can be disabled). With some IKEv1 clients there are some issues in case of reauthentication, though (see issue #937 and related).

EAP-TLS makes it possible to delegate the certificate authentication for IKEv2 clients to the AAA server, but this is unrelated to RADIUS Accounting.

Answer 2

Thanks to ecdsa, I've found several solutions of my problem.

1. Use RADIUS Accounting without RADIUS Authentication.

If eap-radius plugin is enabled with option accounting = yes, strongSwan will send RADIUS message to start accounting, even if eap-radius is not used in ipsec.conf file. In my case this RADIUS message looks like this:

Acct-Status-Type = Start
Acct-Session-Id = 1434531934-1
NAS-Port-Type = Virtual
Service-Type = Framed-User
NAS-Port = 1
NAS-Port-Id = ios-ikev1-fakexauth
NAS-IP-Address = <nas_ip>
Called-Station-Id = <nas_ip>[4500]
Calling-Station-Id = <client_ip>[4500]
User-Name = "C=CH, O=strongSwan, CN=myemail@mail.com"
Framed-IP-Address = 172.20.1.1
NAS-Identifier = strongSwan

I can obtain certificate CN from message and it is enoght for me to make proper accounting. If I want to reject access for some CN I can just reject RADIUS message from stronSwan and ipsec connection will be interrupted.

2. Do accounting and access check in the updown script instead of using RADIUS.

Also I would like to use strongSwan curl plugin for access to the certificate revocation list. But I've found lack of documentation about this plugin. Am I missing something?