2

My problem is I currently develop a new configuration on IKEV2 VPN connection. The main idea is the client VPN routers are authenticate trough a VPN concentrator where an AAA authenticion set to a Radius server. The radius server is continiously says the password doesn't match, I deployed a AAA login authentication on it and it working fine when I log in with the same credentials as I set to the client VPN router.

I make a packet capture on the port where is the VPN connection request received from the client VPN and I also make a packet capture on that port where the Cisco CSR1000V forwarding the authentication request to the radius server (both client and concentrator are CSR100V the radius is a cisco access registrar). My finding is the password are rehashed by the cisco VPN concentrator between the two port. I try to find some solution but I there no forum which dealing this problem. If you know how can I configure to not rehashe the password please let me know.

The configuration is:

crypto ikev2 profile MGMTikev2_profile
 match identity remote fqdn domain 
 identity local fqdn 
 authentication remote pre-share
 authentication local pre-share
 keyring aaa aaa_network
 dpd 30 10 on-demand
 aaa authorization user psk cached
 aaa accounting psk aaa_accounting
 virtual-template 1 mode auto

crypto ikev2 authorization policy default
 route set interface
 route set remote ipv4 172.16.0.0 255.255.255.0

crypto ikev2 proposal IKEV2_PROP
 encryption aes-cbc-256
 integrity md5
 group 19

aaa new-model
aaa authentication login default group AAA_AUTHENTICATION local
aaa authentication ppp aaa_ppp group radius
aaa authorization network aaa_network group radius
aaa accounting network aaa_accounting start-stop group radius
aaa nas port extended
aaa session-id common

aaa group server radius AAA_AUTHENTICATION
 server-private IP address auth-port 1812 acct-port 1813 key <omitted>

radius server VPN_RADIUS
 address ipv4 IP Address auth-port 1812 acct-port 1813
 key <ommited>

I already try aaa server radius dynamic-author and dtls below the radius server configuration.

  • Welcome to Network Engineering! Please edit your question to include your router configuration. Otherwise, we're just guessing. – Ron Trunk Apr 2 at 12:33
  • I updated the question with configuration. – Mátyás Bontovics Apr 2 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.