Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Pfsense + freeradius + Microsoft Active Directory

    Scheduled Pinned Locked Moved Wireless
    25 Posts 4 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F
      freenode
      last edited by

      Hy Guys,
      I want to create a WPA2- Enterprise wifi auth.

      The softwares:

      • pfsense+ with freeradius package
      • windows server 2022 datacenter (this is the AD DC)

      I configured in freeradius the LDAP section.

      And the problem. When I want connect the device ( Iphone), and I fill out the login name, and the password, than the connection will be fail.
      In the pfsense log the error massage: "no nt password".

      If I change the EAP type, than the error massage changed to: "incorrect username"

      I think the first case, the connection between the windows server and the pfsense is works.
      Can freeradius communicate directly with MS AD?

      Thank you in advance!

      warnersmith323W 1 Reply Last reply Reply Quote 1
      • stephenw10S
        stephenw10 Netgate Administrator
        last edited by

        What EAP types are you using? IIRC there are some things there that cannot work there.
        https://docs.netgate.com/pfsense/en/latest/recipes/freeradius-eap.html

        F 1 Reply Last reply Reply Quote 0
        • F
          freenode @stephenw10
          last edited by freenode

          @stephenw10
          Thank you for your comment.

          The setup:
          EAP.png

          The error code:
          error.png

          Only default EAP type: PEAP - any other case the error code is: "invalid user"

          S 1 Reply Last reply Reply Quote 0
          • stephenw10S
            stephenw10 Netgate Administrator
            last edited by

            If you uncheck 'disable weak EAP types' does it work? Or produce a different error?

            Did you set 'LDAP Authentication Support' in the LDAP setup page?

            F 1 Reply Last reply Reply Quote 0
            • F
              freenode @stephenw10
              last edited by

              @stephenw10
              Sorry for my late answer. No effect, if I uncheck. I try the user management by Active Directory. When I complete the setup, then I try authentication under the diagnostics menu its works. So pfsense can communicate with AD by native. BTW if I search on OPNsense forum this issue, than this problem is occur at OPNsense.

              I find out an alternative solution. The name is packetfence
              I will try that in this weekend.

              I will let you know what I came up with.

              1 Reply Last reply Reply Quote 1
              • S
                sebauer @freenode
                last edited by sebauer

                @freenode @stephenw10

                Hi, i'm dealing with the same error. I tried different configurations in the EAP tab and no one is working.
                The packet from the AP is received by the pfsense well, but i can't find the right config for the freeradius the check against the ldap server.

                WhatsApp Image 2023-10-12 at 10.13.12.jpeg

                This is the error when i try connect

                F 1 Reply Last reply Reply Quote 0
                • F
                  freenode @sebauer
                  last edited by

                  @sebauer @stephenw10
                  That can solve the problem? Enable LDAP signing on MS AD
                  According to this, in default the LDAP signing is disable on MS AD?

                  @sebauer which LDAP solution do you use?

                  S 1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    I'm pretty sure this is because the eap type used means radius can only ever see an authenticated or not type of responce from ldap and it's trying to login itself. Hence the 'no nt password' error.
                    You have to configure the radius to LDAP link to allow that in order to handle the requests from wireless clients.

                    1 Reply Last reply Reply Quote 0
                    • S
                      sebauer @freenode
                      last edited by

                      @freenode This is my config on the EAP tab:

                      Screenshot 2023-10-12 at 10-44-44 pfSense.home.arpa - Services FreeRADIUS EAP.png

                      S 1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        And the LDAP config from radius?

                        1 Reply Last reply Reply Quote 0
                        • S
                          sebauer @sebauer
                          last edited by sebauer

                          @sebauer and the LDAP tab:
                          Screenshot 2023-10-12 at 10-45-25 pfSense.home.arpa - Services FreeRADIUS LDAP - 1.png

                          1 Reply Last reply Reply Quote 0
                          • stephenw10S
                            stephenw10 Netgate Administrator
                            last edited by

                            Ok, so try disabling 'LDAP Authentication Support'. As it says there that doesn't work with EAP because it requires a plaintext password and radius never has that.

                            S 1 Reply Last reply Reply Quote 0
                            • S
                              sebauer @stephenw10
                              last edited by

                              @stephenw10 I changed that and I'm getting the same error hahaha.
                              WhatsApp Image 2023-10-12 at 11.15.08.jpeg

                              I'm trying this like for a month ago, i'm working in this lab for my work and i never find someone trying something like this until now.
                              Radius never was very friendly when error happens

                              1 Reply Last reply Reply Quote 0
                              • stephenw10S
                                stephenw10 Netgate Administrator
                                last edited by

                                What does the LDAP server show when it tries that?

                                S 1 Reply Last reply Reply Quote 0
                                • S
                                  sebauer @stephenw10
                                  last edited by sebauer

                                  @stephenw10 Don't say nothing. The logs in pfsense are showing nothing of the LDAP.
                                  But i checked changing the IP from the LDAP server for the IP of my pfsense to see if can use the server authentication that i created en pfsense to test the connection to the LDAP server first and the log says:

                                  WhatsApp Image 2023-10-12 at 11.43.37.jpeg

                                  In the LDAP server i can't see anything because I haven't the privileges yet because i'm new in this work

                                  1 Reply Last reply Reply Quote 0
                                  • stephenw10S
                                    stephenw10 Netgate Administrator
                                    last edited by

                                    Ok, then to test this I would setup an LDAP server you can see the logs in and authenticate against that first so you can see how it fails. Or doesn't.

                                    S 1 Reply Last reply Reply Quote 0
                                    • S
                                      sebauer @stephenw10
                                      last edited by

                                      Hi @stephenw10 i was thinking: there is a way to configure the Post-Auth-Type??? Since the error says "(5) login incorrect (no auth-type found: rejecting the user via Post-auth-type = reject)" is there a way to set to the post-auth a value that works with ldap?

                                      1 Reply Last reply Reply Quote 0
                                      • stephenw10S
                                        stephenw10 Netgate Administrator
                                        last edited by

                                        Only whatever is there in the Freeradius LDAP config AFAIK.

                                        S 1 Reply Last reply Reply Quote 0
                                        • S
                                          sebauer @stephenw10
                                          last edited by

                                          Hello @stephenw10, I have some updates regarding the FreeRADIUS configuration against the LDAP server. By capturing packets and analyzing them with Wireshark, I noticed a few things:

                                          1. The first thing is that the LDAP server insists on using EAP for authentication. When we try to authenticate using MD5 or GTC, the LDAP server rejects the packet because the security protocol is not very secure.

                                          2. We tried enabling the "Enable LDAP for Authentication" option, and in Wireshark, we can see a packet exchange in which the user attempting to authenticate to the WiFi network is sent back to pfSense, where we have our FreeRADIUS. However, we are still encountering the error that says: "Login Incorrect (mschap: FAILED: No-NT Password. Cannot perform authentication)."

                                          So, from what I can see, the connection to the LDAP server is working perfectly. What I don't understand is where the issue with the password lies. It could be on the FreeRADIUS side when it receives the request from the Access Point, or it might be in the LDAP server's response.

                                          1 Reply Last reply Reply Quote 0
                                          • stephenw10S
                                            stephenw10 Netgate Administrator
                                            last edited by

                                            #2 there is expected. When using EAP Freeradius never has the password to use to authenticate the user. It can only pass the username to authorise it. As I understand it at least. But I'm pretty confident on that since the option notes that.

                                            S 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.