freeRadius / Unifi AP / EAP-TTLS ?
-
@furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.
As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.
-
@johnpoz Well ok. Removed and restarted pfSense, no change. Tablet still thinks password is wrong...
I tried increasing the dhcp scoop slightly on the wifi net, and that shows in the log at least. But still no requests or anything from the tablet... In fact, nothing is coming through to the wifi net at all... I will look for the windows comp...
Ok, finally got windows up, but when trying to connect to my wifi, I get a password prompt... I have not installed the cert yet, will have too google that too, thought it would have asked when detecting TLS
-
@furom no your going to have to set that up..
Here just set it up on my windows machine.
Created a new user in freerad windows, created cert and exported the p12..
Here is screenshots of steps.
here is windows showing the connection.. got ip from dhcp
Once I imported the p12, it auto selected the cert and authed as you can see above from the log on pfsense.
-
@johnpoz Thanks, right now battling with windows... For some reason I don't have this
When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.
I will see if I have better luck with Linux instead...
-
@furom what version of windows are you running?
Not sure if home for example supports it even, or maybe if your way behind in version?
-
@johnpoz Thanks... I removed the drive again, but only weeks ago I updated to whatever latest resembles to. It should be a Win10 Pro, it says on the bottom sticker at least.
But Linux thinks the "windows" cert is corrupted. Will redo that. The CA seemed to be accepted though
-
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl
-
@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..
Maybe try wpa2 enterprise if wpa3 isn't working..
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..
My Access Point can't handle WPA3, but yes, WPA Enterprise is chosen for the SSID...
-
@furom What AP are you running? What controller version? I have some older gen2 AP the uap-ac-lite, pro and -lr.. And they support it.. What firmware are you on for your AP.. Are they gen 1??
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom What AP are you running? What controller version?
I'm using an AC Lite and latest Unifi...
-
@furom the AC lite can do wpa3, what firmware do you have on it?
I am running 7.4.156 for the controller and 6.5.52 for firmware on my uap-ac-lite, all 4 of my APs on on this firmware.. I have a flex hd which is newer but don't really use it for anything - its connected to my controller but disabled, it use to be my son's that I bought for him when he first bought his house, but he changed his ISP and got some AX wifi gateway with his fiber - so his usg and flex hd came back to me and put on a shelf, haven't figured out where I could place the flex hd that would make any sense so it just sits on the floor of my computer room and I just update it when new firmware comes out ;)
-
@furom I almost think I was lucky last time when I got it working... Now when I tries sometimes either one or both of the certs cannot be selected on the tablet... If I reset the cert store and re-import them I can start over. Perhaps it is simply worn out...? I mean, all flash eventually wear out, perhaps it's just acting up... :/ I may have an even older one around somewhere... This is the "new" one, lol
Hm... "Latest" as I called it is actually " 6.5.28.14491". It usually tells me if there is anything new to install... Maybe I have blocked it's checking, which would be suboptimal...
-
@furom or maybe it was never actually doing eap-tls and you just thought it was ;)
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom or maybe it was never actually doing eap-tls and you just thought it was ;)
Well, I'm pretty sure as it did require the certificate, it actually ran EAP-TTLS. Now I reinstalled the CA and Cert and the CA vansished even before I got to install it once... I'm very puzzled... I see no other explanation than that the storage on it is unreliable
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
EAP-TTLS
You know those are way different right - the client isn't authed by cert in ttls
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I see no other explanation than that the storage on it is unreliable
And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
EAP-TTLS
You know those are way different right - the client isn't authed by cert in ttls
True, not only. I had a separate radius server for that one until I got my USG. You can have it require a valid CA cert. I remember it as a bit tricky, but questionable if this isn't actually worse... I blame it on the tablet... ;) I cannot say for sure it is faulty, but why certs just disappear is else unheard of here...
-
@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.
Connected right away
edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..
