Information is obtained from IKEv2 authorization. IKEv2 configuration mode allows IKE peers to exchange configuration information such as IP addresses and routes. The attributes from implicit user authorization are called cached attributes. Implicit authorization is performed as part of EAP authentication The attributes from group authorization are called group attributes.Īaa authorization user cached command in the IKEv2 profile to enable implicit user authorization. Group authorization is based on the generic portion of the peer The attributes from user authorization are called user attributes.Īaa authorization group command in the IKEv2 profile to enable group authorization. User authorization is based on the user-specific portion of the IKEv2 authorization types are as follows:Īaa authorization user command in the IKEv2 profile to enable user authorization.

IKEv2 authorization is mandatory only if the peer requests an IP address Name-mangler keyword or be directly specified in the command. The username for authorization can either be derived from On the RADIUS server, and contains local and/or remote attributes. IKEv2 authorization provides a policy for an authenticated session by using the AAA. IKEv2 Exchange with the query-identity Keyword IKEv2 Name Mangler The figure below shows the IKEv2 exchange for EAP authentication with theįigure 2. IKEv2 Exchange Without the query-identity Keyword The figure below shows IKEv2 exchange for EAP authentication without theįigure 1. The FlexVPN client IKEv2 identity used as the EAP identity. The EAP identity queried from the client when the The EAP identity provided by the EAP server with the EAP success message. If the authentication succeeds, the EAP server is expected to return the authenticated EAP identity to the FlexVPN serverĪfter EAP authentication, the EAP identity used for the IKEv2 configuration is obtained from the following sources in the Server then relays EAP messages between the remote access (RA) client and the EAP server until the authentication is complete.

The FlexVPN server starts the EAP authentication by passing the FlexVPN client’s EAP identity to the EAP server the FlexVPN IP addresses cannot be used as the EAP identity. Query-identity keyword is not configured and the FlexVPN client’s IKEv2 identity is an IPv4 or IPv6 address, the session is terminated because Query-identity keyword is configured, the FlexVPN server queries the EAP identity from the client otherwise, the FlexVPN client’s IKEv2 FlexVPN clients authenticate using EAP by skipping the AUTH payload in the IKE_AUTH The FlexVPN server is configured to authenticate FlexVPN clients that use EAP by configuring theĪuthentication remote eap command in IKEv2 profile configuration mode. While a FlexVPN client authenticates the FlexVPN client using EAP, the FlexVPN server must authenticated by using certificates.

Ikev2 name mangler