My problem is I currently develop a new configuration on IKEV2 VPN connection. The main idea is the client VPN routers are authenticate trough a VPN concentrator where an AAA authenticion set to a Radius server. The radius server is continiously says the password doesn't match, I deployed a AAA login authentication on it and it working fine when I log in with the same credentials as I set to the client VPN router.
I make a packet capture on the port where is the VPN connection request received from the client VPN and I also make a packet capture on that port where the Cisco CSR1000V forwarding the authentication request to the radius server (both client and concentrator are CSR100V the radius is a cisco access registrar). My finding is the password are rehashed by the cisco VPN concentrator between the two port. I try to find some solution but I there no forum which dealing this problem. If you know how can I configure to not rehashe the password please let me know.
The configuration is:
crypto ikev2 profile MGMTikev2_profile match identity remote fqdn domain identity local fqdn authentication remote pre-share authentication local pre-share keyring aaa aaa_network dpd 30 10 on-demand aaa authorization user psk cached aaa accounting psk aaa_accounting virtual-template 1 mode auto crypto ikev2 authorization policy default route set interface route set remote ipv4 172.16.0.0 255.255.255.0 crypto ikev2 proposal IKEV2_PROP encryption aes-cbc-256 integrity md5 group 19 aaa new-model aaa authentication login default group AAA_AUTHENTICATION local aaa authentication ppp aaa_ppp group radius aaa authorization network aaa_network group radius aaa accounting network aaa_accounting start-stop group radius aaa nas port extended aaa session-id common aaa group server radius AAA_AUTHENTICATION server-private IP address auth-port 1812 acct-port 1813 key <omitted> radius server VPN_RADIUS address ipv4 IP Address auth-port 1812 acct-port 1813 key <ommited>
I already try aaa server radius dynamic-author and dtls below the radius server configuration.