IPsec/IKEv2 EAP+Radius

RouterOS General
1

Hello, i am trying to set up VPN for roadwarriors.
i’ve been doing it all day and now i think i am lost. making IPsec/IKEv2 EAP+radius.
Radius - NPS Windows server 2016 (it was working for l2tp+ipsec)
so maybe some guru can help me with this questions:

  1. Certificates. as i understand it - with Radius i dont need client certificates. is it right?
  2. CA+server certificates - Should i create self-signed certs on mikrotik? should i import them on radius? should i import CA on client side? server certificate - what common name should i use?

Plus i was trying to find guides for Eap+radius authentication - is there any? bc wiki cant answer my questions.
thank you in advance.

2

This is my ipsec settings

/ip ipsec mode-config
add address-pool=ipsec-IKEv2 name=ipsec-IKEv2 split-include=192.168.x.x/24
/ip ipsec policy group
add name=ipsec-IKEv2
/ip ipsec profile
set [ find default=yes ] dh-group=modp1024 dpd-interval=disable-dpd enc-algorithm=aes-128
add dh-group=ecp256,modp2048,modp1536,modp1024 enc-algorithm=aes-256 hash-algorithm=sha256 name=ipsec-IKEv2
/ip ipsec peer
add exchange-mode=ike2 name=ipsec-IKEv2 passive=yes profile=ipsec-IKEv2 send-initial-contact=no
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-256-cbc,aes-128-cbc lifetime=1h pfs-group=modp2048
add auth-algorithms=sha256,sha1 enc-algorithms=aes-256-cbc lifetime=1d name=ipsec-IKEv2 pfs-group=none
/ip ipsec identity
add auth-method=eap-radius certificate=NPS_Server generate-policy=port-strict mode-config=ipsec-IKEv2 peer=ipsec-IKEv2 \
    policy-template-group=ipsec-IKEv2
/ip ipsec policy
add dst-address=172.16.x.x/24 group=ipsec-IKEv2 proposal=ipsec-IKEv2 src-address=0.0.0.0/0 template=yes
/ip ipsec settings
set xauth-use-radius=yes

Radius:
/radius
add address=192.168.x.x certificate=NPS_Server secret=12345678 service=ipsec

I am getting 13801 error on windows client. and no auth events on radius. seems like its still on phase1
Remote peer is created and established for 30sec and then IPsec log in memory “killing ike2 SA…”

Where am i wrong?

3

Most (if not all) EAP authentication methods requires certificates. Some methods require only the CA certificates while others require a client certificate. You will need to generate self-signed certificates on either the router or the RADIUS server. The RADIUS server will require its own server (end-entity) certificate. The IPsec server (router) will require its own server certificate as well specified under the “certificate” parameter under Identities. The client will only need the CA certificate in most cases, for example, if EAP-MSCHAPv2 is used. You do not need to specify “certificate” under /radius menu. It is for RadSec communication which you can set under “protocol” parameter. But leave it to UDP for now. Common name does not matter in most cases. What matters is the SAN (Subject Alt. Name) which should match the servers address or DNS name to which the client will connect. I would also advise enabling these logging topics on the router for you to better understand what is going on:

/system logging
add topics=ipsec,!packet
add topics=radius
4

Ty for answering, but are you sure that ipsec server cerificate should be under indetities and not radius server certificate? bc in some topics people say otherwise.

5

It depends. You most likely can use the same certificate on IPsec responder and RADIUS server, but the certificates SAN will have to match the IPsec server for IKE to establish.

6

I did some tests. problem is definetly in certificates.
Radius is working fine - i managed to login on mikrotik via user from NPS.
this is how i did my certificates:
/certificate
add name=ipsecCA common-name=ipsecCA subject-alt-name=IP:my-WANip,IP:my-LANip key-usage=digital-sig
nature,key-encipherment,data-encipherment,key-cert-sign,crl-sign key-size=2048 days-valid=3650
add name=ipsecServer common-name=ipsecServer subject-alt-name=IP:my-WANip,IP:my-LANip key-usage=dig
ital-signature,key-encipherment,data-encipherment,tls-server key-size=2048 days-valid=3650
add name=ipsecClient common-name=ipsecServer key-usage=tls-client key-size=2048 days-valid=3650

singed them - > imported them on Radius → imported ca and client on client side(windows).
still not working.

7

updated to 6.45.6. still receiving 13801 error from windows, no errors in mikrotik ipsec/debug log, nothing on radius.
what am i doing wrong ?

8

I managed to work it out with windows 10. it accepted the cirtificate and settings of the radius attributes in network policy should be “Tunnel type : IP encapsulating…”
on windows 7 i am still getting 13801 - looks like it does not accept server certificate.

9

Ok, i finaly did it!
There were 2 problems with win7 client:

  1. for some f*** reason win7 certmgr.msc will properly add CA certificate only if u actualy open mmc console and click import.
  2. Common Name in server certificate is crusial for win7. win10 was ok with random name. but win 7 wanted to see my WAN IP.
10

Friends,
Please throw in some advice!
MT device set up as gw router also as accesspoint + plus a radius server.

I have a working freeradius3 authorizing wireless clients. I now want to add the same wireless users as ipsec-ikev2 clients and to authorize them against the same radius server.
The problem I struggle with: how to get the router to send auth requests to the radius.

  • no network traffic problem, radius clients.conf is set and expecting connection, router radius setting is pointing right,
  • mode eap-radius is set in identities
  • x-auth to use radius is set
  • certificates are created and also good (wireless work well)

When changed to direct ipsec-ikev connection to the router all is working, so it is not a certificate problem. Although I suspect the the problem to be along the correct placement of certificates.

Technical info:
Wireless auth on radius works using EAP mode without user:pass. All common /android,ios,mac,win/ work well with this set up.
Router : RB2011-UAS-2HND (6.45.6)
Radius : freeradius3 on OpenWRT (RB450G)

What am I missing?

11

Hi @gliepins, Did you come right here?

maybe check out this topic:http://forum.mikrotik.com/t/ikev2-eap-radius-windows-10-not-working-but-working-on-apple-devices/121460/1
IKEv2 needs the certificate and intermediate certificate configured to send to the windows OS (since windows doesn’t have the intermediate certificate in its local store).
its either that or having to import the certificate into the windows local computer store (seems easier to just specify it in mikrotik)
I know you mentioned certificates were not an issue, as wireless was fine, but I noticed n SSTP you didnt need to specify the intermediate certificate but n IKEv2 you do.

I do see you did say taking RADIUS out of the setup and it all worked fine, but that seems odd as you would then need a client certificate since IKE2 without radius doesnt allow username/password combo…Or maybe Im getting confused (been a long day).

Hope this helps.