• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

WPA_Supplicant

Scheduled Pinned Locked Moved General pfSense Questions
39 Posts 5 Posters 3.5k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    stephenw10 Netgate Administrator
    last edited by Oct 29, 2023, 5:24 PM

    @GPz1100 said in WPA_Supplicant:

    https://pastebin.com/bxg7qda4

    Mmm, that looks like it's only for the change to OpenSSL 3, which isn't in 2.7 (yet). Or in 23.05.1. 🤔

    G 1 Reply Last reply Oct 29, 2023, 5:37 PM Reply Quote 0
    • G
      GPz1100 @stephenw10
      last edited by GPz1100 Oct 30, 2023, 3:09 PM Oct 29, 2023, 5:37 PM

      @stephenw10 ^^I believe it was 23.09 that introduced the new openssl.

      It's unclear why the OP was unsuccessful with 2.70, given it does include the vlan0 patched wpa_supplicant with the same wpa_supplicant.conf

      @AiC0315 said in WPA_Supplicant:

      Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

      This error suggests a missing conf parameter in wpa_supplicant.conf, specifically

      ctrl_interface=DIR=/var/run/wpa_supplicant

      This goes ABOVE the "network={" array.

      A Z 3 Replies Last reply Oct 30, 2023, 2:18 PM Reply Quote 1
      • A
        AiC0315 @GPz1100
        last edited by Oct 30, 2023, 2:18 PM

        @GPz1100

        I'll add that parameter when i have time and see what happens.

        Thank you both for helping me try to figure this out

        1 Reply Last reply Reply Quote 0
        • A
          AiC0315 @GPz1100
          last edited by Oct 31, 2023, 1:30 PM

          @GPz1100
          Had time to mess with this last night. using this config.

          ctrl_interface=DIR=/var/run/wpa_supplicant

          eapol_version=1
          ap_scan=0
          fast_reauth=1
          network={
          ca_cert="/root/WPA/Certs/CA.pem"
          client_cert="/root/WPA/Certs/Client.pem"
          eap=TLS..
          eapol_flags=0
          identity="XX:XX:XX:XX:XX:XX" # Internet (ONT) interface MAC address must match this value
          key_mgmt=IEEE8021X
          phase1="allow_canned_success=1"
          private_key="/root/WPA/Certs/PrivateKey.pem"
          }
          Works perfectly on 23.05.1 but does not get an IP on 2.7.0. Im using the wpa_supplicant posted on the dslforum link.
          At this point I'm about to give up. Now I just have to dercide if I want to pay for plus from here on out

          G 1 Reply Last reply Oct 31, 2023, 3:51 PM Reply Quote 0
          • S
            stephenw10 Netgate Administrator
            last edited by Oct 31, 2023, 2:14 PM

            You tried using the included wpa_supplicant? 2.7 should have the patch to accept vlan0 by default.

            A 1 Reply Last reply Oct 31, 2023, 3:52 PM Reply Quote 0
            • G
              GPz1100 @AiC0315
              last edited by Oct 31, 2023, 3:51 PM

              @AiC0315 Where/when are you initializing wpa_supplicant?

              A 1 Reply Last reply Oct 31, 2023, 3:56 PM Reply Quote 0
              • A
                AiC0315 @stephenw10
                last edited by Oct 31, 2023, 3:52 PM

                @stephenw10
                Yes, I used the wpa_supplicant file posted in the dslreports post

                S 1 Reply Last reply Oct 31, 2023, 4:07 PM Reply Quote 0
                • A
                  AiC0315 @GPz1100
                  last edited by Oct 31, 2023, 3:56 PM

                  @GPz1100
                  /sbin/ifconfig igb0 ether "XX:XX:XX:XX:XX:XX" && /root/WPA/wpa_supplicant -B -Dwired -i igb0 -c /root/WPA/wpa_supplicant.conf -P/var/run/wpa_supplicant.pid && sleep 10 && /usr/sbin/wpa_cli logon. (early shellcmd)

                  wpa_cli logoff && sleep 10 && wpa_cli logon (shellcmd)

                  G 1 Reply Last reply Oct 31, 2023, 4:01 PM Reply Quote 0
                  • G
                    GPz1100 @AiC0315
                    last edited by Oct 31, 2023, 4:01 PM

                    @AiC0315

                    What's the result of wpa_cli status in shell?

                    It should look something like this.
                    dc9b29c1-30e2-4d5f-84e4-2a0b296811b7-image.png

                    A 1 Reply Last reply Oct 31, 2023, 4:03 PM Reply Quote 0
                    • A
                      AiC0315 @GPz1100
                      last edited by Oct 31, 2023, 4:03 PM

                      @GPz1100
                      Thanks,
                      I will take a look when I am able to install 2.7.0 back on my machine.

                      1 Reply Last reply Reply Quote 0
                      • S
                        stephenw10 Netgate Administrator @AiC0315
                        last edited by Oct 31, 2023, 4:07 PM

                        @AiC0315 said in WPA_Supplicant:

                        Yes, I used the wpa_supplicant file posted in the dslreports post

                        Yes I meant did you try the default wpa_supplicant version that's included in 2.7?

                        A 1 Reply Last reply Nov 3, 2023, 7:08 PM Reply Quote 0
                        • Z
                          zC @GPz1100
                          last edited by Nov 3, 2023, 4:05 PM

                          @GPz1100 said in WPA_Supplicant:

                          @stephenw10 ^^I believe it was 23.09 that introduced the new openssl.

                          It's unclear why the OP was unsuccessful with 2.70, given it does include the vlan0 patched wpa_supplicant with the same wpa_supplicant.conf

                          @AiC0315 said in WPA_Supplicant:

                          Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

                          This error suggests a missing conf parameter in wpa_supplicant.conf, specifically

                          ctrl_interface=DIR=/var/run/wpa_supplicant

                          This goes ABOVE the "network={" array.

                          What about

                          Failed to connect to non-global ctrl-ifname: (nil) error: Success

                          1 Reply Last reply Reply Quote 0
                          • A
                            AiC0315 @stephenw10
                            last edited by Nov 3, 2023, 7:08 PM

                            @stephenw10

                            Here is the output of wpa_cli status:

                            Selected interface 'igb0'
                            bssid=01:80:c2:00:00:03
                            freq=0
                            ssid=
                            id=0
                            mode=station
                            pairwise_cipher=NONE
                            group_cipher=NONE
                            key_mgmt=IEEE 802.1X (no WPA)
                            wpa_state=ASSOCIATED
                            address=
                            Supplicant PAE state=HELD
                            suppPortStatus=Unauthorized
                            EAP state=FAILURE
                            uuid=59fbef4f-
                            

                            this was using the wpa_supplicant in 2.7.0.

                            1 Reply Last reply Reply Quote 0
                            • H
                              henryzhou
                              last edited by henryzhou Oct 1, 2024, 5:40 AM Oct 1, 2024, 5:22 AM

                              Sorry for reopen such an old thread.
                              I'm running 24.03 but my eap tls authentication always failed.

                              My wpa_supplicant.conf is the same as the op (except the mac address)
                              I'm using the system build-in wpa_supplicant.

                              H G 2 Replies Last reply Oct 1, 2024, 8:00 AM Reply Quote 0
                              • H
                                henryzhou @henryzhou
                                last edited by henryzhou Oct 1, 2024, 8:02 AM Oct 1, 2024, 8:00 AM

                                I also tried 23.09.1 and got the same result.
                                wpa_cli status shows
                                wpa_state=associated
                                supplicant pae state=held
                                suppPortStatus=Unauthorized
                                EAP state=FAILURE

                                Same certificate set works on Mikrotik.
                                I've checked the identity mac address which are the same.

                                Please help, it really drives me crazy

                                1 Reply Last reply Reply Quote 0
                                • S
                                  stephenw10 Netgate Administrator
                                  last edited by Oct 1, 2024, 12:26 PM

                                  You are also trying to connect to AT&T?

                                  H 1 Reply Last reply Oct 1, 2024, 4:09 PM Reply Quote 0
                                  • H
                                    henryzhou @stephenw10
                                    last edited by henryzhou Oct 1, 2024, 4:43 PM Oct 1, 2024, 4:09 PM

                                    @stephenw10 Yes, AT&T U-verse fiber. I confirm it's gpon not xgspon.

                                    I also notice that the system has two wpa_supplicant. one is under /usr/sbin, the other under /usr/local/sbin. Both are version 2.10 and both failed the 1x authentication.

                                    The system was originally running CE 2.7.2 and then upgrade to 23.09.1/24.03.

                                    1 Reply Last reply Reply Quote 0
                                    • G
                                      GPz1100 @henryzhou
                                      last edited by Oct 1, 2024, 5:23 PM

                                      @henryzhou https://www.reddit.com/r/PFSENSE/comments/18jz0uc/installing_att_bypass_on_a_clean_install_of/

                                      Follow the guide above. Additional settings are needed as pfsense 24.03 (and possibly earlier) uses openssl 3.0. Att's certs do not meet the minimum security standards so weaker ciphers must be allowed.

                                      S H 2 Replies Last reply Oct 1, 2024, 7:09 PM Reply Quote 2
                                      • S
                                        stephenw10 Netgate Administrator @GPz1100
                                        last edited by Oct 1, 2024, 7:09 PM

                                        @GPz1100 said in WPA_Supplicant:

                                        Att's certs do not meet the minimum security standards

                                        Nice! 🙄

                                        G 1 Reply Last reply Oct 1, 2024, 9:57 PM Reply Quote 0
                                        • H
                                          henryzhou @GPz1100
                                          last edited by Oct 1, 2024, 7:35 PM

                                          @GPz1100 Thank you so much.

                                          After adding openssl_ciphers=DEFAULT@SECLEVEL=0 to my wpa_supplicant.conf and set OPENSSL_CONF to a customized config file it works.

                                          I do appreciate your help. All of you.

                                          1 Reply Last reply Reply Quote 1
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                                            This community forum collects and processes your personal information.
                                            consent.not_received