Cisco IPSec and XAuthPassword profile key

Question

Cisco IPSec and XAuthPassword profile key

I am creating the config profile for iPhone, while using iPhone Configuration Utility I can not enter password for IPSec VPN as the application does not have UI for that.
I had found, though, that manually writing "XAuthPassword" key into the config profile does the trick, iPhone do recognize that entry and sets the password automatically on applying profile.
So, the questions are:

1) Is this config key officially supported on iOS for IPSec VPN? If yes, then starting with which version?
2) Because iPhone Configuration Utility does not allow me to create signed profiles containing XAuthPassword key, can I manually sign the configuration profile I had edited?

Thank you in advance

iPhone 4, iOS 4

Posted on Apr 6, 2011 8:49 PM

Reply

Answer 1

SofaKng

Level 1

0 points

Aug 23, 2011 8:03 AM in response to Rustam Muginov

I'm wondering the exact same questions.

I'm using VPN On-Demand (IPsec + certificates) but iOS still prompts me for my Xauth password every time the VPN tries to connect. I don't like this behavior because I thought the purpose of VPN On-Demand was for a seemless experience. (I also use a PIN code to protect the iOS device, etc)

Reply

Answer 2

o-sdn-o

Level 1

0 points

Sep 12, 2011 8:52 AM in response to Rustam Muginov

Hi,

in « iOS Configuration Profile Reference »:

IPSec Dictionary Keys

XAuthEnable – Integer:1 if XAUTH is ON, 0 if it is OFF. Used for Cisco IPSec.

It turn off XAuth and do not ask for User/Password.

You can try this option by editing configuration profile like this:

<key>XAuthEnabled</key>

<integer>0</integer>

<key>AuthenticationMethod</key>

<string>Certificate</string>

but I can`t resolve the problem, I seems it is a ios (4.3.1) bug, because my vpn-server works fine with other vpn-clients, like Cisco VPN Client, with certificate authentication and without xauth.

Best regards!

Reply

Answer 3

o-sdn-o

Level 1

0 points

Sep 12, 2011 9:36 AM in response to Rustam Muginov

with XAuthEnabled=0 in configuration profile

IOS starting authentication by auth RSA sig instead auth XAUTHInitRSA (option XAuthEnabled=0 works as expected), but connection process stopped before IOS request for Mode Config parameters.

Reply

Answer 4

o-sdn-o

Level 1

0 points

Sep 12, 2011 10:56 PM in response to Rustam Muginov

on IOS 4.3.5 same behavior. does someone set up a working configuration to establish vpn on-demand using certificates without user authentication using User/Password (without xauth)?

Reply

Answer 5

SofaKng

Level 1

0 points

Sep 13, 2011 4:38 AM in response to Rustam Muginov

I'd love to know the answer to that too... (IPsec certificate auth w/o XAuth)

Reply