Hi, I’m having trouble setting up IKEv2/IPSec RSA vpn server with RADIUS for user auth.
My setup is: Mikrotik with ROS 7.9 → FreeRADIUS → OpenLDAP. VPN clients are Android 13 devices. I specifically want to authenticate users using their personal certificates as I already use those for WiFi (EAP-TLS). And because the certificates are stored in OpenLDAP, I need to use RADIUS. Which works great for WiFi, but not for IPSec. The problem is that the RADIUS server is not queried when a user is connecting using RSA (No requests are sent to the FreeRADIUS server, nothing in mikrotik log regarding radius). Therefore connecting to the vpn fails with
identity not found for server:vpn.awalker.cz peer: RFC822: celebrant@vpn.awalker.cz
But when I change the VPN type in my phone to IKEv2/IPSec MSCHAPv2 then the RADIUS server is used (FreeRADIUS gets the request).
Not sure which config parts are relevant, here is a bit regarding radius and ipsec identities:
What am I doing wrong? Is what I want even supported? I know that I could store the certificates locally on the mikrotik router and set up IPSec Identities with Auth. Method = “digital signature” and use the certificates.. but I don’t want to have to store them in two places (mikrotik + ldap) and manage user profiles twice (mikrotik ipsec identity + ldap). mikrotik_log.txt (9.26 KB)
Hi,
how did you set the peer on server side?
what is the “my-id” on server compared to the cert id?
Note: If you are using “My ID user FQDN” in IpSec config then “subjectaltname” extension should be set on certificate, and must match the value set on remote peers “My ID user FQDN”.
Do you have all certs installed (CA and intermediate, if any)
A printout of
/ipsec/export
would be helpful to diagnose your problem.
Also a look at
/certificate/print detail where name=vpn.awalker.cz
Hello. I have tried to set “my-id” on server to fqdn “vpn.awalker.cz” and I have also tried my-id=auto with no success. my-id=“user fqdn” is not allowed for auth-method=“eap radius”.
