On Tue, Dec 15, 2015 at 01:36:48PM -0500, Alan DeKok wrote:
On Dec 15, 2015, at 1:30 PM, François Lacombe <fl.infosreseaux@gmail.com> wrote:
Strongswan only redirects EAP packets to the radius. The EAP packets come directly from users.
StrongSWAN is sending RADIUS packets to FreeRADIUS. StrongSWAN is the RADIUS client.
Nevertheless I agree that NAS-IP-Address should always be the IP of strongswan server instead of the users' one.
Yes. That's what the RFCs say the NAS-IP-Address should be.
In my experience setting up strongSwan and FreeRADIUS recently, strongSwan behaved correctly with regard to RADIUS. (Though in the end I used IKEv2 which doesn't do EAP, so I just get RADIUS accounting.) Matthew -- Matthew Newton, Ph.D. <mcn4@le.ac.uk> Systems Specialist, Infrastructure Services, I.T. Services, University of Leicester, Leicester LE1 7RH, United Kingdom For IT help contact helpdesk extn. 2253, <ithelp@le.ac.uk>