WPA(2) Enterprise + FreeRadius

Panja

I would like to use WPA2 enterprise with FreeRadius.
I followed this guide: http://hubpages.com/technology/How-to-Set-Up-a-Radius-Server-on-pfSense-Using-the-FreeRadius-Package

All is working. I'm just wondering is it really this simple to setup? ;D
At the moment my iPhone 6S (iOS 9.0.2) is connected without any problems.

johnpoz

yeah its pretty simple, there are some gotchas if you want to use eap-tls with ios devices wanting password on the p12 that isn't done with cert manager.

Panja

Indeed it was easy. :D

Hmmm serious?
I have it running with TLS with my self-signed cert on my pfSense box and did not need to do anything on my iPhone.
Only thing I got was a question to trust the certificate on iOS (probably due to being self-signed).


radiusd[48071]: Login OK: [Panja] (from client panja-radius port 0 via TLS tunnel)

johnpoz

That is not using eap-tls there difference

Panja

Ok, sorry my bad.

EAP-TLS is more secure?
I am using PEAP right?

Btw pity I have a few devices that cannot be setup with WPA2 enterprise.
I need to add a separate SSID with WPA2 personal for those devices.

johnpoz

yeah it is a pity devices that do not support wpa2 enterprise, means you still have to run a psk ssid for those - I have a nest thermostat and a harmony smart hub (remote control) for example that I have looked into if they would be adding. And doesn't seem like any plans to do so..

Yeah eap-tls is more secure, each device that connects needs cert installed from the CA, not just a username password and trusting the server cert. The server also has to see and validate the cert issued to the device. Its a bit more work setting it up to be sure because you have to create the certs for each device. Best option for a laptop would be to store this cert on a smartcard for example.. But this is difficult on a ipad or smartphone, etc..

Issue ran into is that cert manager in pfsense does not put a password on the .p12 - but in ios it will not allow you to import without. So have to run it through openssl putting a psssword on it.

Panja

Thanks for the very clear answer!

I'm probably going to run 2.4GHz with WPA2 AES Personal and 5GHz with WPA2 Enterprise.
The devices I have that do not support WPA Enterprise are also devices that do not have 5GHz support (printer, Logitech Squeezebox).