Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    WPA_Supplicant

    Scheduled Pinned Locked Moved General pfSense Questions
    39 Posts 5 Posters 3.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • GPz1100G
      GPz1100 @AiC0315
      last edited by

      @AiC0315

      What's the result of wpa_cli status in shell?

      It should look something like this.
      dc9b29c1-30e2-4d5f-84e4-2a0b296811b7-image.png

      A 1 Reply Last reply Reply Quote 0
      • A
        AiC0315 @GPz1100
        last edited by

        @GPz1100
        Thanks,
        I will take a look when I am able to install 2.7.0 back on my machine.

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator @AiC0315
          last edited by

          @AiC0315 said in WPA_Supplicant:

          Yes, I used the wpa_supplicant file posted in the dslreports post

          Yes I meant did you try the default wpa_supplicant version that's included in 2.7?

          A 1 Reply Last reply Reply Quote 0
          • Z
            zC @GPz1100
            last edited by

            @GPz1100 said in WPA_Supplicant:

            @stephenw10 ^^I believe it was 23.09 that introduced the new openssl.

            It's unclear why the OP was unsuccessful with 2.70, given it does include the vlan0 patched wpa_supplicant with the same wpa_supplicant.conf

            @AiC0315 said in WPA_Supplicant:

            Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

            This error suggests a missing conf parameter in wpa_supplicant.conf, specifically

            ctrl_interface=DIR=/var/run/wpa_supplicant

            This goes ABOVE the "network={" array.

            What about

            Failed to connect to non-global ctrl-ifname: (nil) error: Success

            1 Reply Last reply Reply Quote 0
            • A
              AiC0315 @stephenw10
              last edited by

              @stephenw10

              Here is the output of wpa_cli status:

              Selected interface 'igb0'
              bssid=01:80:c2:00:00:03
              freq=0
              ssid=
              id=0
              mode=station
              pairwise_cipher=NONE
              group_cipher=NONE
              key_mgmt=IEEE 802.1X (no WPA)
              wpa_state=ASSOCIATED
              address=
              Supplicant PAE state=HELD
              suppPortStatus=Unauthorized
              EAP state=FAILURE
              uuid=59fbef4f-
              

              this was using the wpa_supplicant in 2.7.0.

              1 Reply Last reply Reply Quote 0
              • H
                henryzhou
                last edited by henryzhou

                Sorry for reopen such an old thread.
                I'm running 24.03 but my eap tls authentication always failed.

                My wpa_supplicant.conf is the same as the op (except the mac address)
                I'm using the system build-in wpa_supplicant.

                H GPz1100G 2 Replies Last reply Reply Quote 0
                • H
                  henryzhou @henryzhou
                  last edited by henryzhou

                  I also tried 23.09.1 and got the same result.
                  wpa_cli status shows
                  wpa_state=associated
                  supplicant pae state=held
                  suppPortStatus=Unauthorized
                  EAP state=FAILURE

                  Same certificate set works on Mikrotik.
                  I've checked the identity mac address which are the same.

                  Please help, it really drives me crazy

                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    You are also trying to connect to AT&T?

                    H 1 Reply Last reply Reply Quote 0
                    • H
                      henryzhou @stephenw10
                      last edited by henryzhou

                      @stephenw10 Yes, AT&T U-verse fiber. I confirm it's gpon not xgspon.

                      I also notice that the system has two wpa_supplicant. one is under /usr/sbin, the other under /usr/local/sbin. Both are version 2.10 and both failed the 1x authentication.

                      The system was originally running CE 2.7.2 and then upgrade to 23.09.1/24.03.

                      1 Reply Last reply Reply Quote 0
                      • GPz1100G
                        GPz1100 @henryzhou
                        last edited by

                        @henryzhou https://www.reddit.com/r/PFSENSE/comments/18jz0uc/installing_att_bypass_on_a_clean_install_of/

                        Follow the guide above. Additional settings are needed as pfsense 24.03 (and possibly earlier) uses openssl 3.0. Att's certs do not meet the minimum security standards so weaker ciphers must be allowed.

                        stephenw10S H 2 Replies Last reply Reply Quote 2
                        • stephenw10S
                          stephenw10 Netgate Administrator @GPz1100
                          last edited by

                          @GPz1100 said in WPA_Supplicant:

                          Att's certs do not meet the minimum security standards

                          Nice! ๐Ÿ™„

                          GPz1100G 1 Reply Last reply Reply Quote 0
                          • H
                            henryzhou @GPz1100
                            last edited by

                            @GPz1100 Thank you so much.

                            After adding openssl_ciphers=DEFAULT@SECLEVEL=0 to my wpa_supplicant.conf and set OPENSSL_CONF to a customized config file it works.

                            I do appreciate your help. All of you.

                            1 Reply Last reply Reply Quote 1
                            • GPz1100G
                              GPz1100 @stephenw10
                              last edited by

                              @stephenw10 said in WPA_Supplicant:

                              Nice! ๐Ÿ™„

                              Don't shoot the messenger :). Technically, these certs are for internal use. I suppose these could be updated via firmware, but like most things att, doing so will probably create more damage than it solves.

                              Eventually gpon/eapol may fade away in favor of xgs and newer technologies.

                              1 Reply Last reply Reply Quote 0
                              • H
                                henryzhou
                                last edited by

                                one more thing, does pfsense plus provide a better integration with wpa_supplicant (instead of shellcmd/earlyshellcmd)? I notice this doc https://docs.netgate.com/pfsense/en/latest/recipes/authbridge.html but it basically focuses on bridging the ATT router with pfsense.

                                GPz1100G 1 Reply Last reply Reply Quote 0
                                • GPz1100G
                                  GPz1100 @henryzhou
                                  last edited by

                                  @henryzhou Depends on your use case. Most of us want the att box out of the path entirely. The recipe does the equivalent mode of using netgraph in proxy mode.

                                  Im making use of earlyshell/shell cmd as outlined in the reddit link. We experimented last June (2023) in the discord group with different variations and found that to work best. The info's a bit scattered; poster on reddit did a good job of organizing it all.

                                  It's unclear if you're using an external ont or gone the full fiber--> sfp route. In either even the wpa portion remains the same, just the interfaces change slightly - depending on which stick you use. Some sticks (odi dfp-34x-2c2 or equiv) require passing of a specific vlan to the firewall, others handle all the vlan internally (fs.com/lantiq modules). The wpa part however remains bound to the parent interface, not the vlan.

                                  H 1 Reply Last reply Reply Quote 0
                                  • H
                                    henryzhou @GPz1100
                                    last edited by

                                    @GPz1100 For my pfsense plus setup, i use the external ONT. Because the device (N100) i'm running pfsense plus doesn't have sfp.

                                    The only complain I have against shellcmd is it creates a small delay between the public ip is issued through DHCP and the routing rule setup. So in a short period, the device has the public ip but not being able to access internet.

                                    GPz1100G 1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by

                                      Only when it first connects I assume?

                                      @GPz1100 said in WPA_Supplicant:

                                      Don't shoot the messenger :)

                                      Indeed my eyeroll is firmly in AT&T's direction. ๐Ÿ˜

                                      1 Reply Last reply Reply Quote 0
                                      • GPz1100G
                                        GPz1100 @henryzhou
                                        last edited by

                                        @henryzhou It's really been a none issue. Somewhere around 23.x (I think), the boot timing/sequences got changed a bit. There used to be an issue with the interface getting dropped between early on and by the time it got to "configuring wan....", effectively breaking wpa. This has not been the case since.

                                        And if there is any delay, not a big deal. The system is rebooted once every few months or less.

                                        H 1 Reply Last reply Reply Quote 1
                                        • H
                                          henryzhou @GPz1100
                                          last edited by

                                          @GPz1100 Yes, it's not really an issue but my OCD.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post
                                          Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.