2

I have a strongswan implementation and am running into an issue where when there are two users behind the same NAT, the second one "kicks off" the first one. I was able to resolve the issue using:

  • Machine Certificates.
  • EAP-MSCHAPv2 with unique usernames.

The problem with EAP is that hte usernames have to be unique. "Bob" and "Bill" work fine behind a NAT, however two devices logged in as "Bob" kick each other off (the second device works but the first one stops pinging out). Each user is assigned a unique virtual address from a pool

This is a problem because I want to provision hundreds of devices with a generic username\password. I'm sure PSK could also be used but last time I've tried PSK, two devices with the same PSK would boot each other off.

I prefer to use IKEv2 but can do IKEv1\L2TP if I need to. I would think that this is possible because Strongswan can just figure out how to re-encrypt the return packets using the SPI.

jdoe
  • 53
  • 5
  • Have you find any solution yet ? i am stuck in a similar issue. I have PSK and EAP conn. Connecting EAP connection kicks off the PSK. I opened an issue: https://serverfault.com/questions/908906/strongswan-connecting-psk-eap-at-a-time – Ajji Apr 22 '18 at 16:08

0 Answers0