freeRadius / Unifi AP / EAP-TTLS ?
-
@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.
Connected right away
edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I see no other explanation than that the storage on it is unreliable
And what about your windows machine then? It doesn't even think the ssid your connecting to is eap-tls? Why can you not even present a cert?
No idea. It installed correct it seemed, but it will not recognize it... I have issues on Linux now as well.. It just refuse to accept the export passwords. I have tried all variants I can think of, with and without, "test" to be exact, exprted as x.509 and as PKCS12... Tried setting password with openssl... Nothing seems to work. It is "secure", I must say, lol
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom I just got my chromebook connected.. It didn't install the ca from .p12 but installed the user certs, once I installed the ca crt that I created for my freerad stuff - it saw my user account that I had installed from the p12.
Connected right away
edit: question for you - so the only thing you will ever connect to this using eap is some ancient tablet? Why bother to be honest then? Just use wpa2/3-psk and be done with it.. Seems like you trying to setup a complex setup for not sure what the reason is other than learning curve.. Which your having issues with just the basics.. I pretty much gave you step by step with screenshots of all my settings and connected multiple different types of clients. I did have some weirdness myself with the android tablet.. But really I chock that up to my own blindness that didn't use the same case in the name, and it requires fqdn where windows and iphones don't..
I hear you. I will do something about the ancient tablet.. But when shopping for one before it seems 12 is the latest available Android... And if you feel that's old there ought to come a newer one soon...
But even though I have only occasional use of the tablet, I will never ever broadcast my network with less than the best security available. And well, yes, WPA2-Enterprise is hardly the best any more, but the best my lousy gear can handle at the moment...Did I get you correctly, can your UAP-AC-Lite actually do WPA3? I've tried to google that but has been inconclusive. You are on a later version than mine has though.
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
You are on a later version than mine has though.
they didn't make multiple versions of the uap-ac-lite
GuestRoom-BZ.6.5.52# info Model: UAP-AC-Lite Version: 6.5.52.14729 MAC Address: 04:18:d6:c0:1f:6b IP Address: 192.168.2.4 Hostname: GuestRoom Uptime: 520119 seconds NTP: Synchronized Status: Connected (http://192.168.2.12:8080/inform) GuestRoom-BZ.6.5.52#There is a first gen uap-ac
https://help.ui.com/hc/en-us/articles/4409162471447-UniFi-Network-Identify-your-Access-Point-Model
And yes my uap-ac-lite does wpa3.. Here I moved my phone into the guestroom so it would connect to the AP in there..
You can download a profile for iphone to give you details of what you connected to and auth, etc..
You can download them here
https://developer.apple.com/bug-reporting/profiles-and-logs/Not sure why they don't just show this info out of the box.. Guess not going to do you much good since you don't have an iphone you can play with or ipad.
But from that you can see, that I connected to my guest AP which is a uap-ac-lite, using wpa3-enterprise. I can validate that what ap its connected by matching up the bssid, and with iwconfig on the ap it lists the bssid for each ssid you have.. So that is matching, and also the controller will list what clients are connected to which AP..
So yeah the uap-ac-lite supports wpa3, maybe you way behind on its firmware.. I know wpa3 was added to them with a firmware update.. I always run the latest beta which is currently the 6.5.52. If I recall wpa3 was added to the gen2 AP like back in 5.43 or something firmware.. Are you running something older than that?
And I am pretty sure the controller would scream at me if not all of my AP supported wpa3.. They don't support the high security 192 mode.. From my previous looking into that you need atleast gen3 AP for that.
-
@johnpoz Oh, beta... That explains it. I always verify mine against UBNT here(https://www.ui.com/download/unifi/unifi-ap-ac-lite/uap-ac-lite), and it seems to match my version to the dot. Mine would most certainly be the gen 1. I never run beta if there isn't something substantial about it. Where do you get their software from?
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
shopping for one before it seems 12 is the latest available Android
No there are some that have 13 that is for sure, and I just did a quick google and 14 is out or is coming for some of the higher end Samsungs that is for sure.. I am not aware of what specific makes and models come with what, I was not looking to spend any real money on my train ride tablet ;)
At home I rarely use tablet/iphone/ipad, I have my PC and access to all my tools and multiple large monitors and access anything via a click of a few buttons on my full keyboard and mouse, etc. Why would I use a tablet... Tablet is good for when I want to watch something while sitting on the train ;) heheh
I am old schooler - I like my mechanical keyboard, with some feedback to what I am typing, etc. I use a tablet when its the only thing I have - or it makes sense like watching a movie on a train or plane and pain in the ass to breakout a full laptop, etc.
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
Mine would most certainly be the gen 1
then it isn't a uap-ac-lite.. It would be just a uap-ac.. Those are OLD, and eol I am pretty sure.. Just the normal uap-ac might be still life, but pretty sure they announced end of life for like
UAP-AC-EDU
UAP-AC-IW-PROthere was a bit of stink about all over the unifi forums.
As to running beta bringing something the table - you mean like wpa3 ;) hehehe
I don't have any issues running with the latest and greatest beta for my AP or even the controller - because its only a couple of minutes to rollback if need be. I run my controller as a VM, and always take snapshot before doing any update on it.. And with the AP, its pretty simple to roll back to previous firmware.. To be honest I think in the multiple years I have been running them, I might have only rolled back on firmware like once.. Because it broke something..
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
Mine would most certainly be the gen 1
then it isn't a uap-ac-lite..
I had to check, and I do indeed have a UAP-AC Lite. So my bad then, not a gen 1, which isn't all that bad. Perhaps still old, but not ancient... :)
As to running beta bringing something the table - you mean like wpa3 ;) hehehe
Fair point... I want that... But then again, have nothing that could talk to it, so have to figure that one out first, then I may be more interested in beta... lol
I don't have any issues running with the latest and greatest beta for my AP or even the controller - because its only a couple of minutes to rollback if need be. I run my controller as a VM, and always take snapshot before doing any update on it.. And with the AP, its pretty simple to roll back to previous firmware.. To be honest I think in the multiple years I have been running them, I might have only rolled back on firmware like once.. Because it broke something..
So true. I run mine as VM as well. I had a UCK, which was so terribly slow at the end I got all sort of faults. I never regret running it as a VM... Should have done that from the beginning really, bit thought it would have benefits running on proprietary hardware...
-
@furom Time for a break here now. But really... Thanks a buch for all you have done, tried and showed me. I am certain it will be a breeze to get working once I have the new tablet! :) Found a new series on Neflix that shall rush through my pfSense for a while now... :)
-
@furom LOL! Literally just hours after ordering a new tablet I finally found the issue!
I had forgot to add the wifi vlan to the 2100 switch... That's why it was so strangely quiet when sniffing for traffic... Ironically I had this net defined from the beginning, but removed it when I "decided" to give up on this...
Then I'll just redo it tomorrow for WPA3 when the new one arrives :)
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
just hours after ordering
What did you order - just curious.
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
just hours after ordering
What did you order - just curious.
A Samsung A8, it has Android 13, so figure it will last a little while at least. It is probably not very powerful, but should be plenty for an occasional movie
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
Samsung A8
I was looking at those for my train tablet, but ended up with the p11, slightly bigger screen and slightly more battery.
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
Samsung A8
I was looking at those for my train tablet, but ended up with the p11, slightly bigger screen and slightly more battery.
Yeah, the bigger screen would have been nice, but price jumped quite a bit for just those points of an inch, and when ordering I still wasn't sure I would make it work. Now I have two... But will keep the old one around for a while. It has some update I apparently haven't installed yet. Didn't have time today to verify if it actually is a legit one or not, but would really expect it to be. Just weird I haven't seen it before.
Documenting this all now, but the main issue all along was the 2100's switch...
