IKEv2 CP and EAP support: Difference between revisions
(Created page with "CP without EAP. This rather straight forward. But is it used? Useful? Does StrongSWAN support it? Design challenge pose to support EAP: AUTH exchange has [CP] , TSi, TSr...") |
No edit summary |
||
| Line 9: | Line 9: | ||
http://tools.ietf.org/html/rfc5996#section-2.15 vs http://tools.ietf.org/html/rfc5996#section-2.19 | http://tools.ietf.org/html/rfc5996#section-2.15 vs http://tools.ietf.org/html/rfc5996#section-2.19 | ||
Configuration names: | |||
In general there may be conflicts in functionality between IKEv1 and IKEv2. | |||
The username is called xauthusername in IKEv1. Is it appropriate to call that in v2? | |||
Also some of the IKEv1 option keywords have a specific meaning in IKEv1. Does that work for v2? | |||
xauthby, xauthname, modecfgserver, xauthserver, xauthclient, modecfgclient, modecfgpull, modecfgdns1, modecfgdns2,modecfgdomain, modecfgbanner, modecfgwins1, modecfgwins2 | |||
May be a solution is first create a v2 only connection and then use new names. | |||
WPA Supplicant source code has ikev2 has eap_server_ikev2.c what is that? | WPA Supplicant source code has ikev2 has eap_server_ikev2.c what is that? | ||
Revision as of 04:01, 26 September 2014
CP without EAP.
This rather straight forward. But is it used? Useful? Does StrongSWAN support it?
Design challenge pose to support EAP:
AUTH exchange has [CP] , TSi, TSr. When a receiver get these it reply with EAP and goes off to EAP authentican. However, it must hang on to [CP], TSi, TSr. And after the authentication respond to it. After EAP is complete the initiator does not send TSi and TSr again.
http://tools.ietf.org/html/rfc5996#section-2.15 vs http://tools.ietf.org/html/rfc5996#section-2.19
Configuration names:
In general there may be conflicts in functionality between IKEv1 and IKEv2.
The username is called xauthusername in IKEv1. Is it appropriate to call that in v2?
Also some of the IKEv1 option keywords have a specific meaning in IKEv1. Does that work for v2? xauthby, xauthname, modecfgserver, xauthserver, xauthclient, modecfgclient, modecfgpull, modecfgdns1, modecfgdns2,modecfgdomain, modecfgbanner, modecfgwins1, modecfgwins2
May be a solution is first create a v2 only connection and then use new names.
WPA Supplicant source code has ikev2 has eap_server_ikev2.c what is that?