Hi all,
I have been tasked with implementing 802.1X for our office wireless & wired connectivity - wireless through an Aruba AP, wired through a
Dell PowerConnect 6200 switch - by using FreeRADIUS (2.1.12) and our backend
LDAP server (Open DS). FreeRADIUS is running on Ubuntu 10.04.
* Wireless 802.1X auth is working properly (verified on both OS X and Win 7) using TTLS+PAP - debug output attached for reference.
* Wired 802.1X auth is not working, and I am not sure why. This is where I am hoping to be pointed in the right direction - debug output attached for this as well.
For wireless, my supplicant (laptop running OS X Lion) has an 802.1X
profile configured (tried with and without the FreeRADIUS server's ca
certificate (ca.der)), connects to the Aruba, gets prompted for
login/password, the credentials pass auth with LDAP, a certificate gets
installed in my Keychain, and network access is granted. Yay!
For wired, I have the same 802.1X profile configured, the laptop connects to the switch,
EAP begins, the Access-Challenge gets returned, but there is seemingly no
further communication done.
(It has been confirmed using tcpdump that the supplicant is receiving the response from FreeRADIUS.)
I get a Warning message from FreeRADIUS indicating that EAP did not
complete. The message directs me to a Certificate Compatibility page on
the FR wiki, but unfortunately that points a lot of fingers at Windows,
which my laptop is not running.
We have also tried creating the certs with the bootstrap program and modifying eap.conf accordingly, to no avail.
For reference, eapol_test also fails in the same manner when running locally on the FreeRADIUS box.
I am sure I am missing something - probably something simple - but I just have not been able to figure it out, and I am clearly not very
good at reading the debug output. :-(
I have been researching this for quite some time and have found a lot of helpful information from people on this list, so I hope somebody can help me pinpoint the issue.
My apologies if I was too wordy. Any help is greatly appreciated.
-- RG