Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    freeRadius / Unifi AP / EAP-TTLS ?

    Scheduled Pinned Locked Moved pfSense Packages
    97 Posts 3 Posters 30.3k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      furom @johnpoz
      last edited by furom

      @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

      @furom your lower version of android might not like high, try the low or legacy option.

      You said your on 7 right - man that is pretty old, I thought my tablet was behind with 12.. heheh

      btw: the security on getting this cert from your cert manager to your client should be good anyway - not like this is leaving your network, etc. make sure you use a dumb password that is impossible to mess up, its only need to install the certs on your tablet - ie just used "test"..

      Yeah, I have thought of getting a new one but as this works (kind of), it feels dumb to do, but may have to soon. "The computer race" is something I have never tried to win, it is not possible with new models every 15 minutes... 🙄
      Made a new try, this time adding pw with openssl, and now it installs, but still "certificate unknown"... So I probably mess up the fields when creating it still...
      I did

      • ed25519
      • Common Name: tablet.domain.local
      • Cert Type: User Certificate
      • Alt Names: tablet.domain.local

      which should be the minimum required, right?

      Just struck me, the CA maybe is warped... did I forget something with that maybe, will figure...

      F 1 Reply Last reply Reply Quote 0
      • F
        furom @furom
        last edited by furom

        @furom Something is very wrong with my tablet... It forgets the certs I install... Sometimes I can't see what I just installed... So perhaps an issue with the tablet itself more than the certs... Add to that, the strange firmware that just appeared for it too :/
        It is old, but did work before, so should again. I will reinstall Android on it and see if that may help. If not, it may be time to get a new one

        or... could it be it can't handle ed25519 certs... hm. will try rsa once more...

        F 1 Reply Last reply Reply Quote 0
        • F
          furom @furom
          last edited by

          @furom Unreal... You have been most helpful John, and still this fails to authenticate. I will put this to rest for now, it is not that important. Should be more fun than anything. If I ever manage to make it work again I will document every part down to the letter (thought I had that but no), but that is for a rainy day I suppose.

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @furom
            last edited by

            @furom do you not have something else to test with, iphone, ipad, windows machine?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            F 1 Reply Last reply Reply Quote 0
            • F
              furom @johnpoz
              last edited by

              @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

              @furom do you not have something else to test with, iphone, ipad, windows machine?

              I may have an old windows laptop still around, it's should be Win10 I think, will see if I can find it, but now when I think of it, a VM with Ubuntu should do just as good, or would Windows have any advantages here?

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @furom
                last edited by johnpoz

                @furom A vm that has access to your wireless should be able to work as well.

                Don't you have phone - that is running newer version of android maybe?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                F 1 Reply Last reply Reply Quote 0
                • F
                  furom @johnpoz
                  last edited by furom

                  @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                  @furom A vm that has access to your wireless should be able to work as well.

                  Well, I was thinking of wired 802.1X, that would still test the certs, right? But true, I've never really heard of a true wireless VM, probably not the easiest route...

                  Don't you have phone - that is running newer version of android maybe?

                  That I can configure, no

                  I'm still uncertain if I'm actually creating the certs to contain the correct stuff or not. I have read too much, tried way too many different configs. There aren't that many fields to fill, but plenty to create mistakes with stil.

                  I have the devices ("tablet")/("windows"), a domain ("domain.local") and a user ("raduser").

                  1. Common Name (CN): tablet.domain.local
                  2. Country Code: <code>
                  3. Alternative Names: tablet.domain.local

                  Would this seem to be correct?

                  8124c1df-5d4d-47a4-8c0d-4a4dada728ac-image.png
                  Then in the connecting end, on the device;

                  • ca cert
                  • client cert
                  • domain: domain.local
                  • identity: unsure of this one, think it should be 'tablet.domain.local'?
                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @furom
                    last edited by johnpoz

                    @furom yes you have to have identity set and it has to exactly match your freeraduser.

                    users.jpg

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    F 1 Reply Last reply Reply Quote 1
                    • F
                      furom @johnpoz
                      last edited by

                      @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                      @furom yes you have to have identity set and it has to exactly match your freebsd user.

                      users.jpg

                      Thanks. I thought I'd tried that already, but will do it again. It may of course well be something else blocking, but at least I then know the certs are correct, that's one down... :) I'll install it and test connecting with windows. Hoping for some good luck :)

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @furom
                        last edited by

                        @furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

                        It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        F 1 Reply Last reply Reply Quote 1
                        • F
                          furom @johnpoz
                          last edited by

                          @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                          @furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

                          It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

                          OMG... I just may have got it I think. Not tried it yet, but from your picture... The "user" I never got what it was used for... It's actually the devices.... the missing link I hope. :)

                          F 1 Reply Last reply Reply Quote 0
                          • F
                            furom @furom
                            last edited by furom

                            @furom Never been as close... Radius auth now passes,

                            63b16c07-945a-4f8a-948c-f66cecf411ef-image.png
                            but my stupid tablet now refuse the IP I want to serve it, so I have more digging to do, but this feels a lot better, thanks!

                            These are the rules for the wifi;
                            38e19035-ef4d-423a-ac46-36a3cc43a63f-image.png
                            I don't see anything blocked, which makes me think this is on the Android side...

                            johnpozJ 1 Reply Last reply Reply Quote 0
                            • johnpozJ
                              johnpoz LAYER 8 Global Moderator @furom
                              last edited by

                              @furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

                              What do you see in the dhcp log?

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              F 1 Reply Last reply Reply Quote 0
                              • F
                                furom @johnpoz
                                last edited by

                                @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                @furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

                                What do you see in the dhcp log?

                                On pfSense, the /var/log/dhcpd.log shows no trace at all from having even tried giving out an IP... :/ Other clients, but nothing for the wifi net... I'm checking the Unifi part as well, but that I have notes from the old setup, so less insecure of those...

                                johnpozJ 1 Reply Last reply Reply Quote 0
                                • johnpozJ
                                  johnpoz LAYER 8 Global Moderator @furom
                                  last edited by johnpoz

                                  @furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

                                  Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

                                  dhcp.jpg

                                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                                  If you get confused: Listen to the Music Play
                                  Please don't Chat/PM me for help, unless mod related
                                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                                  F 1 Reply Last reply Reply Quote 0
                                  • F
                                    furom @johnpoz
                                    last edited by

                                    @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                    @furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

                                    Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

                                    dhcp.jpg

                                    both enabled, and usually working as intended. No change turning them off though. Have restared both pfSense and tablet... Will try to setup the most basic wifi now...

                                    F 1 Reply Last reply Reply Quote 0
                                    • F
                                      furom @furom
                                      last edited by

                                      @furom Weird. If I don't enter "domain" when trying to connect on the tablet it says "Obtaining IP address", but if I do enter it, I instead get "Password may be incorrect"... Not exactly great error messages... dhcp log is still empty from anything related to this... Now running on basic default wifi, no other config than selecting the vlan...

                                      johnpozJ 1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator @furom
                                        last edited by

                                        @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                        I instead get "Password may be incorrect".

                                        where would you be setting a password.. You didn't set a password on your freerad user did you?

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        F 1 Reply Last reply Reply Quote 0
                                        • F
                                          furom @johnpoz
                                          last edited by

                                          @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                          @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                          I instead get "Password may be incorrect".

                                          where would you be setting a password.. You didn't set a password on your freerad user did you?

                                          This one?
                                          404665ea-6dee-4f10-871b-3f9e4d0e4fcf-image.png
                                          I sure did...

                                          johnpozJ 1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator @furom
                                            last edited by johnpoz

                                            @furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.

                                            blank.jpg

                                            As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            F 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.