VPN > IPSec: Strongswan 5.9.10+ prevents EAP-TLS authentication

[Oliver]

A regression in the eap-tls plugin of Strongswan 5.9.10+ prevents EAP-TLS authentication. The log shows:

Code Select Expand

11[IKE] <con1|2> verification of AUTH payload with EAP MSK failed

Details: https://github.com/strongswan/strongswan/discussions/1613

Remedy: Downgrade to Strongswan 5.9.9_1 via

Code Select Expand

opnsense-revert -r 23.1.1 strongswan

But keep in mind that this version is affected by vulnerability CVE-2023-26463.

[franco]

But keep in mind that was fixed in 23.1.4 yesterday? ;)


Cheers,
Franco

[Oliver]

OK, tried again after the upgrade to 23.1.4 (strongswan 5.9.10_1) did not fix the problem for me:

I had to manually restart the IPSec service (which the update apparently did not do), then it worked again.

[franco]

Yep, we don't restart services (unless there is a reboot for other reasons).


Cheers,
Franco