freeRadius / Unifi AP / EAP-TTLS ?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom if your not seeing anything come in for dhcp.. Then that would point to something wrong with your wifi setup.. Its not tagging the ssid vlan correctly, or your switch setup isn't right for the vlan..
Wifi just puts the traffic on the L2 - pfsense would see it.. Your not running maybe dhcp snooping/guarding on your unifi?
both enabled, and usually working as intended. No change turning them off though. Have restared both pfSense and tablet... Will try to setup the most basic wifi now...
-
@furom Weird. If I don't enter "domain" when trying to connect on the tablet it says "Obtaining IP address", but if I do enter it, I instead get "Password may be incorrect"... Not exactly great error messages... dhcp log is still empty from anything related to this... Now running on basic default wifi, no other config than selecting the vlan...
-
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I instead get "Password may be incorrect".
where would you be setting a password.. You didn't set a password on your freerad user did you?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom said in freeRadius / Unifi AP / EAP-TTLS ?:
I instead get "Password may be incorrect".
where would you be setting a password.. You didn't set a password on your freerad user did you?
This one?
I sure did... -
@furom Why?? eap-tls is not meant to use a password.. Do not set a password on your freerad user.. It auths with its cert.
As you see when you setup eap-tls on your tablet and pick ca and cert and identity - where does it let you put in a password? ;) So how would that work if you have a password set on your freerad user.
-
@johnpoz Well ok. Removed and restarted pfSense, no change. Tablet still thinks password is wrong...
I tried increasing the dhcp scoop slightly on the wifi net, and that shows in the log at least. But still no requests or anything from the tablet... In fact, nothing is coming through to the wifi net at all... I will look for the windows comp...
Ok, finally got windows up, but when trying to connect to my wifi, I get a password prompt... I have not installed the cert yet, will have too google that too, thought it would have asked when detecting TLS
-
@furom no your going to have to set that up..
Here just set it up on my windows machine.
Created a new user in freerad windows, created cert and exported the p12..
Here is screenshots of steps.
here is windows showing the connection.. got ip from dhcp
Once I imported the p12, it auto selected the cert and authed as you can see above from the log on pfsense.
-
@johnpoz Thanks, right now battling with windows... For some reason I don't have this
When hitting "connect" it checks network requirements and decides I can't connect. Cert imported fine, no errors.
I will see if I have better luck with Linux instead...
-
@furom what version of windows are you running?
Not sure if home for example supports it even, or maybe if your way behind in version?
-
@johnpoz Thanks... I removed the drive again, but only weeks ago I updated to whatever latest resembles to. It should be a Win10 Pro, it says on the bottom sticker at least.
But Linux thinks the "windows" cert is corrupted. Will redo that. The CA seemed to be accepted though
-
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom maybe linux wants a fqdn on the certs? I don't really have a linux box I could test with eap-tls.. I have lots of vms running linux and freebsd, and even have wsl on my windows - wonder if I could hand over my wifi card to my wsl instance on windows?
Yeah, I had little success with linux either though. It did not seem to accept the export password, so will try setting one with openssl
-
@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..
Maybe try wpa2 enterprise if wpa3 isn't working..
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom so question for you - when you say windows doesn't offer the ability to use certificate... You do have your ssid setup for enterprise right..
My Access Point can't handle WPA3, but yes, WPA Enterprise is chosen for the SSID...
-
@furom What AP are you running? What controller version? I have some older gen2 AP the uap-ac-lite, pro and -lr.. And they support it.. What firmware are you on for your AP.. Are they gen 1??
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom What AP are you running? What controller version?
I'm using an AC Lite and latest Unifi...
-
@furom the AC lite can do wpa3, what firmware do you have on it?
I am running 7.4.156 for the controller and 6.5.52 for firmware on my uap-ac-lite, all 4 of my APs on on this firmware.. I have a flex hd which is newer but don't really use it for anything - its connected to my controller but disabled, it use to be my son's that I bought for him when he first bought his house, but he changed his ISP and got some AX wifi gateway with his fiber - so his usg and flex hd came back to me and put on a shelf, haven't figured out where I could place the flex hd that would make any sense so it just sits on the floor of my computer room and I just update it when new firmware comes out ;)
-
@furom I almost think I was lucky last time when I got it working... Now when I tries sometimes either one or both of the certs cannot be selected on the tablet... If I reset the cert store and re-import them I can start over. Perhaps it is simply worn out...? I mean, all flash eventually wear out, perhaps it's just acting up... :/ I may have an even older one around somewhere... This is the "new" one, lol
Hm... "Latest" as I called it is actually " 6.5.28.14491". It usually tells me if there is anything new to install... Maybe I have blocked it's checking, which would be suboptimal...
-
@furom or maybe it was never actually doing eap-tls and you just thought it was ;)
-
@johnpoz said in freeRadius / Unifi AP / EAP-TTLS ?:
@furom or maybe it was never actually doing eap-tls and you just thought it was ;)
Well, I'm pretty sure as it did require the certificate, it actually ran EAP-TTLS. Now I reinstalled the CA and Cert and the CA vansished even before I got to install it once... I'm very puzzled... I see no other explanation than that the storage on it is unreliable
