freeRadius / Unifi AP / EAP-TTLS ?

furom · May 20, 2023, 8:05 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom do you not have something else to test with, iphone, ipad, windows machine?

I may have an old windows laptop still around, it's should be Win10 I think, will see if I can find it, but now when I think of it, a VM with Ubuntu should do just as good, or would Windows have any advantages here?

johnpoz · May 20, 2023, 8:59 PM

@furom A vm that has access to your wireless should be able to work as well.

Don't you have phone - that is running newer version of android maybe?

furom · May 21, 2023, 7:57 AM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom A vm that has access to your wireless should be able to work as well.

Well, I was thinking of wired 802.1X, that would still test the certs, right? But true, I've never really heard of a true wireless VM, probably not the easiest route...

Don't you have phone - that is running newer version of android maybe?

That I can configure, no

I'm still uncertain if I'm actually creating the certs to contain the correct stuff or not. I have read too much, tried way too many different configs. There aren't that many fields to fill, but plenty to create mistakes with stil.

I have the devices ("tablet")/("windows"), a domain ("domain.local") and a user ("raduser").

Common Name (CN): tablet.domain.local
Country Code: <code>
Alternative Names: tablet.domain.local

Would this seem to be correct?

login-to-view
Then in the connecting end, on the device;

ca cert
client cert
domain: domain.local
identity: unsure of this one, think it should be 'tablet.domain.local'?

johnpoz · May 21, 2023, 11:17 AM

@furom yes you have to have identity set and it has to exactly match your freeraduser.

login-to-view

furom · May 21, 2023, 11:17 AM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom yes you have to have identity set and it has to exactly match your freebsd user.

login-to-view

Thanks. I thought I'd tried that already, but will do it again. It may of course well be something else blocking, but at least I then know the certs are correct, that's one down... :) I'll install it and test connecting with windows. Hoping for some good luck :)

johnpoz · May 21, 2023, 11:20 AM

@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

furom · May 21, 2023, 11:40 AM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)

It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.

OMG... I just may have got it I think. Not tried it yet, but from your picture... The "user" I never got what it was used for... It's actually the devices.... the missing link I hope. :)

furom · May 21, 2023, 12:12 PM

@furom Never been as close... Radius auth now passes,

login-to-view
but my stupid tablet now refuse the IP I want to serve it, so I have more digging to do, but this feels a lot better, thanks!

These are the rules for the wifi;
login-to-view
I don't see anything blocked, which makes me think this is on the Android side...

johnpoz · May 21, 2023, 12:12 PM

@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

What do you see in the dhcp log?

furom · May 21, 2023, 12:21 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?

What do you see in the dhcp log?

On pfSense, the /var/log/dhcpd.log shows no trace at all from having even tried giving out an IP... :/ Other clients, but nothing for the wifi net... I'm checking the Unifi part as well, but that I have notes from the old setup, so less insecure of those...

johnpoz · May 21, 2023, 12:38 PM

@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

login-to-view

furom · May 21, 2023, 12:46 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..

Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?

login-to-view

both enabled, and usually working as intended. No change turning them off though. Have restared both pfSense and tablet... Will try to setup the most basic wifi now...

furom · May 21, 2023, 12:56 PM

@furom Weird. If I don't enter "domain" when trying to connect on the tablet it says "Obtaining IP address", but if I do enter it, I instead get "Password may be incorrect"... Not exactly great error messages... dhcp log is still empty from anything related to this... Now running on basic default wifi, no other config than selecting the vlan...

johnpoz · May 21, 2023, 1:09 PM

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I instead get "Password may be incorrect".

where would you be setting a password.. You didn't set a password on your freerad user did you?

furom · May 21, 2023, 1:09 PM

@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

@furom said in freeRadius / Unifi AP / EAP-TTLS ?:

I instead get "Password may be incorrect".

where would you be setting a password.. You didn't set a password on your freerad user did you?

This one?
login-to-view
I sure did...

johnpoz · May 21, 2023, 1:18 PM

@furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.

login-to-view

As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.

furom · May 21, 2023, 1:51 PM

@johnpoz Well ok. Removed and restarted pfSense, no change. Tablet still thinks password is wrong...

I tried increasing the dhcp scoop slightly on the wifi net, and that shows in the log at least. But still no requests or anything from the tablet... In fact, nothing is coming through to the wifi net at all... I will look for the windows comp...

Ok, finally got windows up, but when trying to connect to my wifi, I get a password prompt... I have not installed the cert yet, will have too google that too, thought it would have asked when detecting TLS

johnpoz · May 21, 2023, 2:09 PM

@furom no your going to have to set that up..

Here just set it up on my windows machine.

Created a new user in freerad windows, created cert and exported the p12..

Here is screenshots of steps.

login-to-view

here is windows showing the connection.. got ip from dhcp

login-to-view

Once I imported the p12, it auto selected the cert and authed as you can see above from the log on pfsense.

furom · May 21, 2023, 2:29 PM

@johnpoz Thanks, right now battling with windows... For some reason I don't have this

login-to-view

When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.

I will see if I have better luck with Linux instead...

johnpoz · May 21, 2023, 2:33 PM

@furom what version of windows are you running?

login-to-view

Not sure if home for example supports it even, or maybe if your way behind in version?