freeRadius / Unifi AP / EAP-TTLS ?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom yes you have to have identity set and it has to exactly match your freebsd user.
Thanks. I thought I'd tried that already, but will do it again. It may of course well be something else blocking, but at least I then know the certs are correct, that's one down... :) I'll install it and test connecting with windows. Hoping for some good luck :)
-
@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)
It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom yeah some little mistake can cause it not to work, ie had Tablet.home.arpa as user and was putting in tablet.home.arpa as my identity ;)
It really shouldn't have to be case sensitive.. So that was really odd, but as soon as I made the case match it worked.
OMG... I just may have got it I think. Not tried it yet, but from your picture... The "user" I never got what it was used for... It's actually the devices.... the missing link I hope. :)
-
@furom Never been as close... Radius auth now passes,
but my stupid tablet now refuse the IP I want to serve it, so I have more digging to do, but this feels a lot better, thanks!These are the rules for the wifi;
I don't see anything blocked, which makes me think this is on the Android side... -
@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?
What do you see in the dhcp log?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom why would it not take the IP it gets from dhcp? Why are you hiding it? Are you trying to hand it something that is not rfc1918? 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12 ?
What do you see in the dhcp log?
On pfSense, the /var/log/dhcpd.log shows no trace at all from having even tried giving out an IP... :/ Other clients, but nothing for the wifi net... I'm checking the Unifi part as well, but that I have notes from the old setup, so less insecure of those...
-
@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..
Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..
Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?
both enabled, and usually working as intended. No change turning them off though. Have restared both pfSense and tablet... Will try to setup the most basic wifi now...
-
@furom Weird. If I don't enter "domain" when trying to connect on the tablet it says "Obtaining IP address", but if I do enter it, I instead get "Password may be incorrect"... Not exactly great error messages... dhcp log is still empty from anything related to this... Now running on basic default wifi, no other config than selecting the vlan...
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I instead get "Password may be incorrect".
where would you be setting a password.. You didn't set a password on your freerad user did you?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I instead get "Password may be incorrect".
where would you be setting a password.. You didn't set a password on your freerad user did you?
This one?
I sure did... -
@furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.
As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.
-
@johnpoz Well ok. Removed and restarted pfSense, no change. Tablet still thinks password is wrong...
I tried increasing the dhcp scoop slightly on the wifi net, and that shows in the log at least. But still no requests or anything from the tablet... In fact, nothing is coming through to the wifi net at all... I will look for the windows comp...
Ok, finally got windows up, but when trying to connect to my wifi, I get a password prompt... I have not installed the cert yet, will have too google that too, thought it would have asked when detecting TLS
-
@furom no your going to have to set that up..
Here just set it up on my windows machine.
Created a new user in freerad windows, created cert and exported the p12..
Here is screenshots of steps.
here is windows showing the connection.. got ip from dhcp
Once I imported the p12, it auto selected the cert and authed as you can see above from the log on pfsense.
-
@johnpoz Thanks, right now battling with windows... For some reason I don't have this
When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.
I will see if I have better luck with Linux instead...
-
@furom what version of windows are you running?
Not sure if home for example supports it even, or maybe if your way behind in version?
-
@johnpoz Thanks... I removed the drive again, but only weeks ago I updated to whatever latest resembles to. It should be a Win10 Pro, it says on the bottom sticker at least.
But Linux thinks the "windows" cert is corrupted. Will redo that. The CA seemed to be accepted though
-
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl
-
@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..
Maybe try wpa2 enterprise if wpa3 isn't working..
