I am setting up an IPSec+L2TP VPN for a couple of Windows boxes connecting to a Debian 7.6 (Wheezy) machine running ipsec tools and xl2tpd/pppd. Client authentication via mschapv2 works well enough; but, I would like to use a 802.1x certificate setup off of a local freeradius installation. What I had in mind was some kind of EAP-TLS pass-through from pppd to the Radius server, analogous to the existing WAP supplicant-server setup. However, pppd in all its patched glory insists on handling EAP-TLS authentication all by itself, basically duplicating efforts.
Has anyone had any success with the same or a similar approach?
Any pointers and/or sanity checks greatly appreciated!
Mike