FreeRADIUS + WPA2 Enterprise + 802.1x = How?

[windexh8er]

OK…  I have an Airport Extreme that I would like to have do 802.1x authentication for WPA2 enterprise encryption.  I guess I don't know enough about FreeRADIUS to get a good enough start.

I have installed FreeRADIUS, added the client and one user.  Except I keep getting 802.1x auth failures when trying to log in.  I did a tcpdump between the extreme and the PFSense server but all I really see is rejects from the RADIUS server back.

Does anybody have a quick and dirty on this?  I feel like I'm missing something.

Thanks!
--windexh8er

[Monoecus]

I run into the same issues. And, honestly, I have no idea how to fix it. There were some forum quotes stating unsure support of the 802.1x protocol. Maybe someone knows more about this.

[Slam]

Ive never used this but a quick search of the pfs mailing list yields this:

http://www.mail-archive.com/support@pfsense.com/msg09383.html

If you are running from a hard drive install you would need to do the following:
        - Install the freeradius package
        - Edit the radius.conf and eap.conf to match your environment
        - Copy your certificates to the pfsense's file system
        - Start freeradius.

I would also suggest having a read through this http://wiki.freeradius.org/Wi-Fi_Protected_Access

Regards

[Monoecus]

Finally, I could make Airport Extreme and Airport Express to run in the WPA2 Enterprise mode. Here is how it works:

• go to the shell

• type: vi /usr/local/etc/raddb/eap.conf

• uncomment all command lines within the brackets of the following protocols: tls and ttls (DO NOT uncomment the commentaries)

• save the file

• restart FreeRADIUS in the Services Menu of the Browser.

• Configure the Airports as Clients on pfSense/Freeradius and configure the wireless settings on the airport as WPA2 Enterprise with the Radius settings you just configured (secret key, etc.)

• Connect to the Airport via your Powerbook and choose "TTLS - PAP" in the 802.1X Configuration menue.

Everything should work fine for now, except that you get a certification warning.

Note that this help is not the safest way to use. At least you need to create new certificates later and place them in /usr/local/etc/raddb/certs