Objective: Use ASA to support native VPN client for RA on current versions of Android, Windows 10/11 (and possibly others) using supported types such as IKEv2/IPSec+EAP/MSCHAPv2 for authentication.
An ASA (ASA5516/9.12) is currently used for IKEv1/LT2P Remote Access and IKEv1/IPSec L2L's, working well. It now needs to support IKEv2/IPSec for RA, as Android has removed support for LT2P (others will likely follow). If possible, would prefer to avoid using AnyConnect, SSL-based or any non-free client software. Would also prefer to use existing usernames on ASA for local authentication as done now with the IKEv1/LT2P, though (as far as I can tell) certificates are also required for IKEv2. Finally, IKEv1/LT2P and IKEv1/IPSec L2L also needs to continue to work as-is.
I have not found online references or articles that specifically address this use case, though this one that describes IKEv2/EAP RA with Windows native is the closest (however the configuration examples are a bit incomplete). This one covers IKEv2 RA, but is for IOS.
There is a CA certificate and a cert for both the ASA and an Android client. Using the native client with IKEv2/IPSec MSCHAPv2, gets as far as "Failed to locate an item in the database". My understanding of this is that it is failing to match the client to a `tunnel-group` - though there is both a tunnel group called `VPNGRP` and `DefaultRAGroup` (which I thought it would fall through to in this case). I had thought that the `ikev2 remote-authentication eap query-identity` would use EAP/PEAP/MSCHAPv2 as the peer's ID. Have also found references that says the certificate's `DN` could be used to match the policy/tunnel-group, however I have not been successful making that work (that may only apply to l2l).
Here's the ASA debug for the point where it fails:
IKEv2-PROTO-7: (143): SM Trace-> SA: I_SPI=324F9A17F65A53FE R_SPI=80B091E1278E373F (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_PROC_ID
IKEv2-PROTO-7: (143): Received valid parameteres in process id
IKEv2-PROTO-7: (143): SM Trace-> SA: I_SPI=324F9A17F65A53FE R_SPI=80B091E1278E373F (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_CHK_IF_PEER_CERT_NEEDS_TO_BE_FETCHED_FOR_PROF_SEL
IKEv2-PROTO-7: (143): SM Trace-> SA: I_SPI=324F9A17F65A53FE R_SPI=80B091E1278E373F (R) MsgID = 00000001 CurState: R_WAIT_AUTH Event: EV_GET_POLICY_BY_PEERID
IKEv2-PROTO-4: (143): Searching policy based on peer's identity 'VPNGRP' of type 'key ID'
IKEv2-PROTO-2: (143): Failed to locate an item in the database
IKEv2-PROTO-7: (143): SM Trace-> SA: I_SPI=324F9A17F65A53FE R_SPI=80B091E1278E373F (R) MsgID = 00000001 CurState: R_VERIFY_AUTH Event: EV_AUTH_FAIL
IKEv2-PROTO-4: (143): Verification of peer's authentication data FAILED
IKEv2-PROTO-4: (143): Sending authentication failure notify
IKEv2-PROTO-7: Construct Notify Payload: AUTHENTICATION_FAILEDIKEv2-PROTO-4: (143): Building packet for encryption.
Also, using a Windows native client, the peer identity type that it tries to match is `IPv4 address` which presents the LAN address of the device adapter (not very helpful). I've tried `peer-id-validate nocheck` and `isakmp identity key-id` and `auto` and does not change the error.
I believe the real issue is that I've reached the limits of my understanding of this configuration and I'm just not able to find any good references that explain how this particular use case may work. I may also be misunderstanding the role of the certificates in this configuration - I had thought that in this case it would replace the use of a `pre-shared-key` string while continuing to allow local/CHAP credentials to enable access for a specific user... this may be an incorrect assumption too.
Any suggestions or clarifications would be most appreciated. Thanks!
Relevant ASA config:
ASA Version 9.12(4)58
!
hostname host
domain-name foo.local
access-list acl_vpn_split extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0
crypto ipsec ikev1 transform-set set_aes-256-hmac esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set set_aes-256-hma_trans esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set set_aes-256-hma_trans mode transport
crypto ipsec ikev2 ipsec-proposal AESSHA256
protocol esp encryption aes-256
protocol esp integrity sha-256
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec profile VPNGRP
set ikev2 ipsec-proposal AES256
set trustpoint TP
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map cdm_vpnclient 10 set ikev1 transform-set set_aes-256-hmac set_aes-256-hma_trans
crypto dynamic-map cdm_vpnclient 10 set ikev2 ipsec-proposal AESSHA256 AES256 AES192
crypto map cm_outside 65535 ipsec-isakmp dynamic cdm_vpnclient
crypto map cm_outside interface outside
crypto ca trustpoint TP
enrollment terminal
subject-name CN=host.foo.local, ...
crl configure
crypto ca trustpool policy
crypto ca certificate chain TP
certificate 02
********
quit
certificate ca *
********
quit
crypto isakmp nat-traversal 30
crypto ikev2 policy 9
encryption aes-256
integrity sha256
group 24
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-256
integrity sha256
group 5
prf sha
lifetime seconds 86400
crypto ikev2 enable outside
crypto ikev2 remote-access trustpoint TP
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
group-policy VPNGRP internal
group-policy VPNGRP attributes
vpn-idle-timeout none
vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec
password-storage enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value acl_vpn_split
intercept-dhcp enable
dynamic-access-policy-record DfltAccessPolicy
tunnel-group DefaultRAGroup general-attributes
address-pool pool_vpn
authentication-server-group (outside) LOCAL
default-group-policy VPNGRP
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *
ikev2 remote-authentication eap query-identity
ikev2 local-authentication certificate TP
tunnel-group DefaultRAGroup ppp-attributes
authentication ms-chap-v2
tunnel-group VPNGRP type remote-access
tunnel-group VPNGRP general-attributes
address-pool pool_vpn
authentication-server-group (outside) LOCAL
default-group-policy VPNGRP
tunnel-group VPNGRP ipsec-attributes
ikev1 pre-shared-key *
ikev2 remote-authentication eap query-identity
ikev2 local-authentication certificate TP
username user password * nt-encrypted
username user2 password * encrypted
Complete ASA debug attached (`100.100.100.100` is client, `200.200.200.200` is ASA).
