I set up FlexVPN with help of https://www.cisco.com/c/en/us/support/docs/security/flexvpn/115755-flexvpn-ike-eap-00.html. But instead of using a RADIUS server I want to use local users. Below is an excerpt from my AAA and FlexVPN setup followed by the error message I am getting when testing through iPhone AnyConnect client. The TEST user verifies on the command line just fine.
Any help much appreciated.
router1#show run aaa
!
aaa authentication login default local
aaa authentication login USER local
aaa authorization exec default local
aaa authorization network GROUP local
username TEST privilege 15 password 0 test
!
aaa attribute list FlexVPN_ATTRIBUTE_LIST
attribute type interface-config "ip mtu 1100"
attribute type interface-config "tunnel key 10"
!
aaa new-model
aaa session-id common
crypto ikev2 authorization policy FlexVPN_LOCAL_POLICY
pool FlexVPN_POOL
dns 4.2.2.2
netmask 255.255.255.0
def-domain beamtechnology.com
aaa attribute list FlexVPN_ATTRIBUTE_LIST
route set interface
!
crypto ikev2 proposal FlexVPN_PROPOSAL
encryption 3des
integrity sha1
group 2
!
crypto ikev2 policy FlexVPN_IKEv2_POLICY
match address local 38.88.174.100
proposal FlexVPN_PROPOSAL
!
!
crypto ikev2 profile FlexVPN_IKEv2_PROFILE
match identity remote address 0.0.0.0
match identity remote key-id SECRET
authentication remote eap query-identity
authentication local rsa-sig
pki trustpoint FlexVPN_TP
aaa authentication eap USER
aaa authorization group eap list GROUP FlexVPN_LOCAL_POLICY
virtual-template 1
!
no crypto ikev2 http-url cert
!
!
ip ssh time-out 60
ip ssh authentication-retries 2
ip ssh version 2
ip scp server enable
!
!
!
crypto ipsec transform-set FlexVPN_TRANSFORM esp-3des esp-sha-hmac
mode tunnel
!
crypto ipsec profile FlexVPN_IPsec_PROFILE
set transform-set FlexVPN_TRANSFORM
set ikev2-profile FlexVPN_IKEv2_PROFILE
---
*Dec 5 02:54:55.304: AAA/BIND(0000511A): Bind i/f
*Dec 5 02:54:55.304: IKEv2:Use authen method list USER
*Dec 5 02:54:55.304: AAA/AUTHEN/LOGIN (0000511A): Pick method list 'USER'
*Dec 5 02:54:55.304: IKEv2:pre-AAA: client sent TEST as EAP-Id response
*Dec 5 02:54:55.304: IKEv2:sending TEST [EAP-Id] as username to AAA
*Dec 5 02:54:55.304: IKEv2:(SA ID = 1):[IKEv2 -> AAA] Authentication request sent
*Dec 5 02:54:55.304: IKEv2:%Unsuccessful AAA response FAIL
*Dec 5 02:54:55.304: IKEv2:(SA ID = 1):[AAA -> IKEv2] Unsuccessful response received
*Dec 5 02:54:55.308: IKEv2:Received response from authenticator
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):: Extensible Authentication Protocol failed
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):SM Trace-> SA: I_SPI=DC166CB622FC43CC R_SPI=6F311212AB7AEE68 (R) MsgID = 2 CurState: R_PROC_EAP_RESP Event: EV_DELETE
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):Action: Action_Null
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):SM Trace-> SA: I_SPI=DC166CB622FC43CC R_SPI=6F311212AB7AEE68 (R) MsgID = 2 CurState: R_VERIFY_AUTH Event: EV_AUTH_FAIL
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):Verification of peer's authentication data FAILED
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):Sending authentication failure notify
*Dec 5 02:54:55.308: IKEv2:Construct Notify Payload: AUTHENTICATION_FAILED
*Dec 5 02:54:55.308: IKEv2:(SESSION ID = 84,SA ID = 1):Building packet for encryption.
Payload contents:
NOTIFY(AUTHENTICATION_FAILED) Next payload: NONE, reserved: 0x0, length: 8
Security protocol id: IKE, spi size: 0, type: AUTHENTICATION_FAILED
---
.png){kind=link}
