diff options
author | Yves-Alexis Perez <corsac@debian.org> | 2019-01-02 10:45:36 +0100 |
---|---|---|
committer | Yves-Alexis Perez <corsac@debian.org> | 2019-01-02 11:07:05 +0100 |
commit | 918094fde55fa0dbfd59a5f88d576efb513a88db (patch) | |
tree | 61e31656c60a6cc928c50cd633568043673e2cbd /testing/tests/ikev2/rw-eap-sim-radius/description.txt | |
parent | 69bc96f6b0b388d35e983f8d27224fa49d92918c (diff) | |
download | vyos-strongswan-918094fde55fa0dbfd59a5f88d576efb513a88db.tar.gz vyos-strongswan-918094fde55fa0dbfd59a5f88d576efb513a88db.zip |
New upstream version 5.7.2
Diffstat (limited to 'testing/tests/ikev2/rw-eap-sim-radius/description.txt')
-rw-r--r-- | testing/tests/ikev2/rw-eap-sim-radius/description.txt | 25 |
1 files changed, 13 insertions, 12 deletions
diff --git a/testing/tests/ikev2/rw-eap-sim-radius/description.txt b/testing/tests/ikev2/rw-eap-sim-radius/description.txt index 6c3c71987..5cb1bacdc 100644 --- a/testing/tests/ikev2/rw-eap-sim-radius/description.txt +++ b/testing/tests/ikev2/rw-eap-sim-radius/description.txt @@ -1,14 +1,15 @@ -The roadwarrior <b>carol</b> sets up a connection to gateway <b>moon</b>. -At the outset the gateway authenticates itself to the client by sending -an IKEv2 <b>RSA signature</b> accompanied by a certificate. -<b>carol</b> then uses the <i>Extensible Authentication Protocol</i> -in association with a <i>GSM Subscriber Identity Module</i> -(<b>EAP-SIM</b>) to authenticate against the gateway <b>moon</b>. -In this scenario, triplets from the file <b>/etc/ipsec.d/triplets.dat</b> -are used instead of a physical SIM card on the client <b>carol</b>. +The roadwarriors <b>carol</b> and <b>dave</b> set up a connection to gateway <b>moon</b>. +At the outset the gateway authenticates itself to the clients by sending +an IKEv2 <b>digital signature</b> accompanied by an X.509 certificate. +<p/> +Next the clients use the GSM <i>Subscriber Identity Module</i> (<b>EAP-SIM</b>) +method of the <i>Extensible Authentication Protocol</i> to authenticate themselves. +In this scenario triplets from the file <b>/etc/ipsec.d/triplets.dat</b> are used +instead of a physical SIM card. +<p/> The gateway forwards all EAP messages to the RADIUS server <b>alice</b> -which also uses a static triplets file. -<p> +which also uses static triplets. +<p/> The roadwarrior <b>dave</b> sends wrong EAP-SIM triplets. As a consequence -the radius server <b>alice</b> returns an <b>Access-Reject</b> message -and the gateway <b>moon</b> sends back an <b>EAP_FAILURE</b>. +the RADIUS server <b>alice</b> returns an <b>Access-Reject</b> message +and the gateway <b>moon</b> sends back <b>EAP_FAILURE</b>. |