Hi All,<br><br>I'm trying to do some EAP-AKA authentication test with radius server.<br><br>I'm using the following testbed. Strongswan-4.3.6 is used as the EAP-AKA peer and server. Hostapd-0.6.10 is used as the radius server.<br>
<br>Testbed:<br><br> Radius server / HLR_Auc<br> | <br>
| <br> | <br> H1 --------- NUT1 ===================== NUT2 --------- H2<br>
EAP-AKA peer EAP-AKA server<br> <br><br><br>Tunnel IPsec is configured between NUT1 and NUT2 to protect traffic between H1 and H2.<br><br>During the test, I launched ping from H1 to H2, then NUT1 is authenticated by Radius server with EAP-AKA, and IPSec SAs are negotiated. Then I terminate the connection on NUT1 and launched ping again to make a second authentication. Since the milenage implementation in charon and in hostapd are different, so I modified one of them (hostapd) a little to yield the "quintuplets"..<br>
<br>The question is that, always full authentication is performed. I looked into the code it seems that hostapd could process FAST RE-AUTHENTICATION, but always a new "sm" structure is allocated, and a full authentication is performed.<br>
<br>Do I miss something ?<br><br>Thanks for any reply.<br><br><br>Regards,<br>Dennis<br><br>