EAP Request for local user with vdom and IKE v2 (timeout from internal EAP_PROXY)
Hello Community,
When I try to use a user I locally created in a vdom for a Dial-Up IPsec IKE v2 VPN with EAP enabled, I get a timeout from FortiGates internal EAP_PROXY according to the logs.
When I switch the vpn to IKE v1 it works fine with the same local user.
Same vpn and user configuration works fine, when I am not using any vdom.
Has anyone a idea, what needs to be done to be able to use local users with EAP and IKE v2 on a vdom?
FortiOS Version is 7.6.6.
Output off the ipsec diagnostic is the following:
[437] start_remote_auth-Total 1 server(s) to try
[1915] handle_req-r=4
[1139] __rad_rxtx-fd 11, state 1(Auth)
[1140] __rad_rxtx-Stop rad conn timer.
[1147] __rad_rxtx-
[612] fnbamd_rad_make_access_request-
[334] __create_access_request-Compose RADIUS request
fnbamd_dbg_hex_pnt[50] EAP msg from client (16) ...
[595] __create_access_request-Created RADIUS Access-Request. Len: 175.
[1175] __rad_rxtx-Sent radius req to server 'EAP_PROXY': fd=11, IP=127.0.0.1(127.0.0.1:1812) code=1 id=34 len=175
[1178] __rad_rxtx-Start rad conn timer.
ike V=VDOM1:4: comes 93.206.30.183:4500->X.X.X.X:4500,ifindex=21,vrf=0,len=61....
ike V=VDOM1:4: comes X.X.X.X:64917->X.X.X.X:4500,ifindex=21,vrf=0,len=89....
ike V=VDOM1:4: IKEv2 exchange=AUTH id=XXXXXXXXXXXXXXXXXXX:00000002 len=85
ike V=VDOM1:4:vpn-vdom1:104320: detected retransmit
ike V=VDOM1:4:vpn-vdom1:104320: waiting for RADIUS response
[1040] __rad_conn_timeout-Connction with EAP_PROXY:127.0.0.1 timed out.
[1323] __rad_error-Ret 10, st = 1.
[301] fnbamd_radius_get_next_auth_prot-Next auth prot EAP
[1346] __rad_error-Failed to reach server.
[1139] __rad_rxtx-fd 11, state 1(Auth)
[1140] __rad_rxtx-Stop rad conn timer.
[1147] __rad_rxtx-
[1175] __rad_rxtx-Sent radius req to server 'EAP_PROXY': fd=11, IP=127.0.0.1(127.0.0.1:1812) code=1 id=34 len=175
[1178] __rad_rxtx-Start rad conn timer.
ike V=VDOM1:4: comes X.X.X.X:64917->X.X.X.X:4500,ifindex=21,vrf=0,len=89....
ike V=VDOM1:4: IKEv2 exchange=AUTH id=XXXXXXXXXXXXXX:00000002 len=85
ike V=VDOM1:4:vpn-vdom1:104320: detected retransmit
ike V=VDOM1:4:vpn-vdom1:104320: waiting for RADIUS response
ike :shrank heap by 331776 bytes
[1083] __rad_job_timeout-Task with EAP_PROXY on server 127.0.0.1 timed out.
[41] __rad_server_free-Freeing 127.0.0.1, ref:2
[1323] __rad_error-Ret 10, st = 1.
[301] fnbamd_radius_get_next_auth_prot-Next auth prot EAP
[1340] __rad_error-
[1291] __rad_try_next_server-
[1264] __rad_stop-
[542] __rad_udp_close-closed.
[1259] __rad_conn_stop-Stop rad conn timer.
[931] fnbamd_rad_get_auth_server-
[1298] __rad_try_next_server-No more server to try.
[1372] __rad_error-
[1259] __rad_conn_stop-Stop rad conn timer.
[1305] fnbamd_rad_process-Result from radius svr 'EAP_PROXY' is 10, req 16763324153901
[1509] fnbamd_rad_process-Challenged: 0, FTK_Challenge: 0, CHG_PWD: 0, Invaid_Digest: 0, No_Message_Authenticator_Attr: 0, State_Len: 0
[2863] fnbamd_rad_result-Error (10) for req 16763324153901
[173] fnbamd_comm_send_result-Not enough buffer for EAP message
[280] fnbamd_comm_send_result-Sending result 10 (nid 0) for req 16763324153901, len=6696
[597] destroy_auth_session-delete session 16763324153901
[1650] fnbamd_rad_stop-
ike V=VDOM1:4:vpn-vdom1:104320 EAP 16763324153901 result FNBAM_TIMEOUT
[1264] __rad_stop-
ike V=VDOM1:4:vpn-vdom1: EAP failed for user "User1"
[1259] __rad_conn_stop-Stop rad conn timer.
ike V=VDOM1:4:vpn-vdom1: EAP response is empty
[1658] fnbamd_rads_destroy-
ike V=VDOM1:4:vpn-vdom1: connection expiring due to EAP failure
ike V=VDOM1:4:vpn-vdom1: going to be deleted
[516] fnbamd_rad_auth_ctx_free-Freeing 'EAP_PROXY' ctx
[1530] fnbamd_rad_auth_ctx_uninit-
[1264] __rad_stop-
[1259] __rad_conn_stop-Stop rad conn timer.
[364] fnbamd_rad_free-Freeing EAP_PROXY, ref:2
[519] fnbamd_rad_auth_ctx_free-
[1661] fnbamd_rads_destroy-
[1979] fnbamd_ldaps_destroy-
[1131] fnbamd_tacs_destroy-
[906] fnbamd_pop3s_destroy-
[1146] fnbamd_ext_idps_destroy-
[2426] handle_req-Rcvd abort req for 16763324153901
[2441] handle_req-Can't abort, no active req 16763324153901
