• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

freeRadius / Unifi AP / EAP-TTLS ?

Scheduled Pinned Locked Moved pfSense Packages
97 Posts 3 Posters 30.4k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • F
    furom @johnpoz
    last edited by May 21, 2023, 2:29 PM

    @johnpoz Thanks, right now battling with windows... For some reason I don't have this

    7c7040f4-9602-47ed-aecf-04002c383bc8-image.png

    When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.

    I will see if I have better luck with Linux instead...

    J 1 Reply Last reply May 21, 2023, 2:33 PM Reply Quote 0
    • J
      johnpoz LAYER 8 Global Moderator @furom
      last edited by May 21, 2023, 2:33 PM

      @furom what version of windows are you running?

      windowsver.jpg

      Not sure if home for example supports it even, or maybe if your way behind in version?

      An intelligent man is sometimes forced to be drunk to spend time with his fools
      If you get confused: Listen to the Music Play
      Please don't Chat/PM me for help, unless mod related
      SG-4860 24.11 | Lab VMs 2.8, 24.11

      F 1 Reply Last reply May 21, 2023, 2:42 PM Reply Quote 0
      • F
        furom @johnpoz
        last edited by May 21, 2023, 2:42 PM

        @johnpoz Thanks... I removed the drive again, but only weeks ago I updated to whatever latest resembles to. It should be a Win10 Pro, it says on the bottom sticker at least.

        But Linux thinks the "windows" cert is corrupted. Will redo that. The CA seemed to be accepted though

        J 1 Reply Last reply May 21, 2023, 2:44 PM Reply Quote 0
        • J
          johnpoz LAYER 8 Global Moderator @furom
          last edited by May 21, 2023, 2:44 PM

          @furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          F 1 Reply Last reply May 21, 2023, 3:11 PM Reply Quote 0
          • F
            furom @johnpoz
            last edited by May 21, 2023, 3:11 PM

            @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

            @furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?

            Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl

            J 1 Reply Last reply May 21, 2023, 3:24 PM Reply Quote 0
            • J
              johnpoz LAYER 8 Global Moderator @furom
              last edited by May 21, 2023, 3:24 PM

              @furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

              enterprise.jpg

              Maybe try wpa2 enterprise if wpa3 isn't working..

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              F 1 Reply Last reply May 21, 2023, 3:40 PM Reply Quote 0
              • F
                furom @johnpoz
                last edited by furom May 21, 2023, 3:42 PM May 21, 2023, 3:40 PM

                @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                @furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..

                My Access Point can't handle WPA3, but yes, WPA Enterprise is chosen for the SSID...

                acc50f97-1813-4416-ae80-0869d25895c8-image.png

                J 1 Reply Last reply May 21, 2023, 4:00 PM Reply Quote 0
                • J
                  johnpoz LAYER 8 Global Moderator @furom
                  last edited by johnpoz May 21, 2023, 4:01 PM May 21, 2023, 4:00 PM

                  @furom What AP are you running? What controller version? I have some older gen2 AP the uap-ac-lite, pro and -lr.. And they support it.. What firmware are you on for your AP.. Are they gen 1??

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  F 1 Reply Last reply May 21, 2023, 4:02 PM Reply Quote 0
                  • F
                    furom @johnpoz
                    last edited by May 21, 2023, 4:02 PM

                    @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                    @furom What AP are you running? What controller version?

                    I'm using an AC Lite and latest Unifi...

                    J F 2 Replies Last reply May 21, 2023, 4:07 PM Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator @furom
                      last edited by May 21, 2023, 4:07 PM

                      @furom the AC lite can do wpa3, what firmware do you have on it?

                      I am running 7.4.156 for the controller and 6.5.52 for firmware on my uap-ac-lite, all 4 of my APs on on this firmware.. I have a flex hd which is newer but don't really use it for anything - its connected to my controller but disabled, it use to be my son's that I bought for him when he first bought his house, but he changed his ISP and got some AX wifi gateway with his fiber - so his usg and flex hd came back to me and put on a shelf, haven't figured out where I could place the flex hd that would make any sense so it just sits on the floor of my computer room and I just update it when new firmware comes out ;)

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      1 Reply Last reply Reply Quote 0
                      • F
                        furom @furom
                        last edited by furom May 21, 2023, 4:15 PM May 21, 2023, 4:09 PM

                        @furom I almost think I was lucky last time when I got it working... Now when I tries sometimes either one or both of the certs cannot be selected on the tablet... If I reset the cert store and re-import them I can start over. Perhaps it is simply worn out...? I mean, all flash eventually wear out, perhaps it's just acting up... :/ I may have an even older one around somewhere... This is the "new" one, lol

                        Hm... "Latest" as I called it is actually " 6.5.28.14491". It usually tells me if there is anything new to install... Maybe I have blocked it's checking, which would be suboptimal...

                        J 1 Reply Last reply May 21, 2023, 4:15 PM Reply Quote 0
                        • J
                          johnpoz LAYER 8 Global Moderator @furom
                          last edited by May 21, 2023, 4:15 PM

                          @furom or maybe it was never actually doing eap-tls and you just thought it was ;)

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                          F 1 Reply Last reply May 21, 2023, 4:57 PM Reply Quote 0
                          • F
                            furom @johnpoz
                            last edited by May 21, 2023, 4:57 PM

                            @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                            @furom or maybe it was never actually doing eap-tls and you just thought it was ;)

                            Well, I'm pretty sure as it did require the certificate, it actually ran EAP-TTLS. Now I reinstalled the CA and Cert and the CA vansished even before I got to install it once... I'm very puzzled... I see no other explanation than that the storage on it is unreliable

                            J 2 Replies Last reply May 21, 2023, 5:03 PM Reply Quote 0
                            • J
                              johnpoz LAYER 8 Global Moderator @furom
                              last edited by May 21, 2023, 5:03 PM

                              @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                              EAP-TTLS

                              You know those are way different right - the client isn't authed by cert in ttls

                              https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

                              An intelligent man is sometimes forced to be drunk to spend time with his fools
                              If you get confused: Listen to the Music Play
                              Please don't Chat/PM me for help, unless mod related
                              SG-4860 24.11 | Lab VMs 2.8, 24.11

                              F 1 Reply Last reply May 21, 2023, 5:33 PM Reply Quote 0
                              • J
                                johnpoz LAYER 8 Global Moderator @furom
                                last edited by May 21, 2023, 5:05 PM

                                @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                I see no other explanation than that the storage on it is unreliable

                                And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                F 1 Reply Last reply May 21, 2023, 5:37 PM Reply Quote 0
                                • F
                                  furom @johnpoz
                                  last edited by May 21, 2023, 5:33 PM

                                  @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                  @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                  EAP-TTLS

                                  You know those are way different right - the client isn't authed by cert in ttls

                                  https://www.securew2.com/blog/eap-tls-vs-eap-ttls-pap

                                  True, not only. I had a separate radius server for that one until I got my USG. You can have it require a valid CA cert. I remember it as a bit tricky, but questionable if this isn't actually worse... I blame it on the tablet... ;) I cannot say for sure it is faulty, but why certs just disappear is else unheard of here...

                                  J 1 Reply Last reply May 21, 2023, 5:35 PM Reply Quote 0
                                  • J
                                    johnpoz LAYER 8 Global Moderator @furom
                                    last edited by johnpoz May 21, 2023, 5:40 PM May 21, 2023, 5:35 PM

                                    @furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

                                    Connected right away

                                    chromebook.jpg

                                    edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    F 1 Reply Last reply May 21, 2023, 5:49 PM Reply Quote 0
                                    • F
                                      furom @johnpoz
                                      last edited by May 21, 2023, 5:37 PM

                                      @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                      @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                      I see no other explanation than that the storage on it is unreliable

                                      And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?

                                      No idea. It installed correct it seemed, but it will not recognize it... I have issues on Linux now as well.. It just refuse to accept the export passwords. I have tried all variants I can think of, with and without, "test" to be exact, exprted as x.509 and as PKCS12... Tried setting password with openssl... Nothing seems to work. It is "secure", I must say, lol

                                      1 Reply Last reply Reply Quote 0
                                      • F
                                        furom @johnpoz
                                        last edited by May 21, 2023, 5:49 PM

                                        @johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:

                                        @furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.

                                        Connected right away

                                        chromebook.jpg

                                        edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..

                                        I hear you. I will do something about the ancient tablet.. But when shopping for one before it seems 12 is the latest available Android... And if you feel that's old there ought to come a newer one soon...
                                        But even though I have only occasional use of the tablet, I will never ever broadcast my network with less than the best security available. And well, yes, WPA2-Enterprise is hardly the best any more, but the best my lousy gear can handle at the moment...

                                        Did I get you correctly, can your UAP-AC-Lite actually do WPA3? I've tried to google that but has been inconclusive. You are on a later version than mine has though.

                                        J 2 Replies Last reply May 21, 2023, 6:15 PM Reply Quote 0
                                        • J
                                          johnpoz LAYER 8 Global Moderator @furom
                                          last edited by johnpoz May 21, 2023, 6:28 PM May 21, 2023, 6:15 PM

                                          @furom said in freeRadius / Unifi AP / EAP-TTLS ?:

                                          You are on a later version than mine has though.

                                          they didn't make multiple versions of the uap-ac-lite

                                          GuestRoom-BZ.6.5.52# info
                                          
                                          Model:       UAP-AC-Lite
                                          Version:     6.5.52.14729
                                          MAC Address: 04:18:d6:c0:1f:6b
                                          IP Address:  192.168.2.4
                                          Hostname:    GuestRoom
                                          Uptime:      520119 seconds
                                          NTP:         Synchronized
                                          
                                          Status:      Connected (http://192.168.2.12:8080/inform)
                                          GuestRoom-BZ.6.5.52# 
                                          
                                          

                                          There is a first gen uap-ac

                                          https://help.ui.com/hc/en-us/articles/4409162471447-UniFi-Network-Identify-your-Access-Point-Model

                                          And yes my uap-ac-lite does wpa3.. Here I moved my phone into the guestroom so it would connect to the AP in there..

                                          You can download a profile for iphone to give you details of what you connected to and auth, etc..

                                          You can download them here
                                          https://developer.apple.com/bug-reporting/profiles-and-logs/

                                          Not sure why they don't just show this info out of the box.. Guess not going to do you much good since you don't have an iphone you can play with or ipad.

                                          But from that you can see, that I connected to my guest AP which is a uap-ac-lite, using wpa3-enterprise. I can validate that what ap its connected by matching up the bssid, and with iwconfig on the ap it lists the bssid for each ssid you have.. So that is matching, and also the controller will list what clients are connected to which AP..

                                          connected.jpg

                                          So yeah the uap-ac-lite supports wpa3, maybe you way behind on its firmware.. I know wpa3 was added to them with a firmware update.. I always run the latest beta which is currently the 6.5.52. If I recall wpa3 was added to the gen2 AP like back in 5.43 or something firmware.. Are you running something older than that?

                                          And I am pretty sure the controller would scream at me if not all of my AP supported wpa3.. They don't support the high security 192 mode.. From my previous looking into that you need atleast gen3 AP for that.

                                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                                          If you get confused: Listen to the Music Play
                                          Please don't Chat/PM me for help, unless mod related
                                          SG-4860 24.11 | Lab VMs 2.8, 24.11

                                          F 1 Reply Last reply May 21, 2023, 6:36 PM Reply Quote 1
                                          87 out of 97
                                          • First post
                                            87/97
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received