Hello everyone, I've read a lot messages in Freeradius Forum and I continued misunderstand why iOS devices (iPhone, iPad) doesn't connect in my WPA-Enterprise wifi network. I've installed and configured a freeradius server, version 3.0.14, over openssl 1.1.0e (both have installed from sources on Debian 8). I've tested connect Android devices to my wifi network and everytime they can connect to the network, but iOS devices have mysterious issues. When I try connect iOS device to my wifi in first time, they can connect perfectly. Though, if this same iOS device lost connection (because it's out of range AP signal or air plane mode turn on by the user for 30 minutes or hours) and try connect again the device doesn't connect. When I've saw the debug mode, I've noticed that EAP-PEAP tunnel athentication was successful and server sent Access-Challenge, but device doesn't answer this challenge. I don't understand why the android devices doesn't this issues. Glad, Igor Sousa Wed Mar 22 07:33:50 2017 : Debug: Waking up in 1.1 seconds. Wed Mar 22 07:33:50 2017 : Debug: (17) Received Access-Request Id 8 from 10.41.17.64:1042 to 10.41.110.86:1812 length 255 Wed Mar 22 07:33:50 2017 : Debug: (17) Message-Authenticator = 0x50eb8b4ea5bffe022eda2db1d905b40e Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x541acf3e5312d64e560d7f91490adef3 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x0208002b19001703010020b525f058fa80f3f09e827ff6899bf36e4cab 3f5023d51a927e3e3accc04d61bd Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from preprocess (rlm_preprocess) Wed Mar 22 07:33:50 2017 : Debug: (17) [preprocess] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 43 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Continuing tunnel setup Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) } # authorize = ok Wed Mar 22 07:33:50 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:50 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Finished EAP session with state 0x541acf3e5312d64e Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Previous EAP request found for state 0x541acf3e5312d64e, released from the list Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent packet with method EAP PEAP (25) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Calling submodule eap_peap to process data Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Continuing EAP-TLS Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Peer sent flags --- Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls verify] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Done initial handshake Wed Mar 22 07:33:50 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: [eaptls process] = ok Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Session established. Decoding tunneled attributes Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: PEAP state phase2 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP method MSCHAPv2 (26) Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Got tunneled request Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Setting User-Name to userTest Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Sending tunneled request to inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) eap_peap: Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : Debug: (17) Virtual server inner-tunnel received request Wed Mar 22 07:33:50 2017 : Debug: (17) EAP-Message = 0x020800061a03 Wed Mar 22 07:33:50 2017 : Debug: (17) FreeRADIUS-Proxied-To = 127.0.0.1 Wed Mar 22 07:33:50 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:50 2017 : Debug: (17) State = 0x1c722cc11d7a36d74beb044945cb21bf Wed Mar 22 07:33:50 2017 : Debug: (17) Service-Type = Framed-User Wed Mar 22 07:33:50 2017 : Debug: (17) Framed-MTU = 1488 Wed Mar 22 07:33:50 2017 : Debug: (17) Called-Station-Id = "40-01-C6-D8-5C-00:AAA-Teste" Wed Mar 22 07:33:50 2017 : Debug: (17) Calling-Station-Id = "4C-57-CA-E2-E9-8D" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Identifier = "3Com Access Point 7760" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Type = Wireless-802.11 Wed Mar 22 07:33:50 2017 : Debug: (17) Connect-Info = "CONNECT 54Mbps 802.11g" Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-IP-Address = 10.41.17.64 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port = 1 Wed Mar 22 07:33:50 2017 : Debug: (17) NAS-Port-Id = "STA port # 1" Wed Mar 22 07:33:50 2017 : Debug: (17) Event-Timestamp = "Mar 22 2017 07:33:50 -03" Wed Mar 22 07:33:50 2017 : WARNING: (17) Outer and inner identities are the same. User privacy is compromised. Wed Mar 22 07:33:50 2017 : Debug: (17) server inner-tunnel { Wed Mar 22 07:33:50 2017 : Debug: (17) session-state: No cached attributes Wed Mar 22 07:33:50 2017 : Debug: (17) # Executing section authorize from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:50 2017 : Debug: (17) authorize { Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) eap: Peer sent EAP Response (code 2) ID 8 length 6 Wed Mar 22 07:33:50 2017 : Debug: (17) eap: No EAP Start, assuming it's an on-going EAP conversation Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: returned from eap (rlm_eap) Wed Mar 22 07:33:50 2017 : Debug: (17) [eap] = updated Wed Mar 22 07:33:50 2017 : Debug: (17) modsingle[authorize]: calling ldap (rlm_ldap) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: rlm_ldap (ldap): Reserved connection (3) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL XLAT Wed Mar 22 07:33:50 2017 : Debug: (uid=%{%{Stripped-User-Name}:- %{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: Parsed xlat tree: Wed Mar 22 07:33:50 2017 : Debug: literal --> (uid= Wed Mar 22 07:33:50 2017 : Debug: XLAT-IF { Wed Mar 22 07:33:50 2017 : Debug: attribute --> Stripped-User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: XLAT-ELSE { Wed Mar 22 07:33:50 2017 : Debug: attribute --> User-Name Wed Mar 22 07:33:50 2017 : Debug: } Wed Mar 22 07:33:50 2017 : Debug: literal --> ) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND (uid=%{%{Stripped-User-Name}:-%{User-Name}}) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: --> (uid=userTest) Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: EXPAND TMPL LITERAL Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Performing search in "ou=people,dc=test,dc=br" with filter "(uid=userTest)", scope "sub" Wed Mar 22 07:33:50 2017 : Debug: (17) ldap: Waiting for search result... Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: User object found at DN "uid=userTest,ou=people,dc=test,dc=br" Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: Processing user attributes Wed Mar 22 07:33:53 2017 : Debug: (17) ldap: control:NT-Password := 0x3145333941394139324632423038413045363942344435414441374535333332 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Released connection (3) Wed Mar 22 07:33:53 2017 : Info: Need 2 more connections to reach 10 spares Wed Mar 22 07:33:53 2017 : Info: rlm_ldap (ldap): Opening additional connection (8), 1 of 24 pending slots used Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Connecting to ldap:// 10.0.0.2:389 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): New libldap handle 0x1d2afa0 Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Waiting for bind result... Wed Mar 22 07:33:53 2017 : Debug: rlm_ldap (ldap): Bind successful Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from ldap (rlm_ldap) Wed Mar 22 07:33:53 2017 : Debug: (17) [ldap] = updated Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from expiration (rlm_expiration) Wed Mar 22 07:33:53 2017 : Debug: (17) [expiration] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from logintime (rlm_logintime) Wed Mar 22 07:33:53 2017 : Debug: (17) [logintime] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: calling pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) pap: Normalizing NT-Password from hex encoding, 32 bytes -> 16 bytes Wed Mar 22 07:33:53 2017 : WARNING: (17) pap: Auth-Type already set. Not setting to PAP Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authorize]: returned from pap (rlm_pap) Wed Mar 22 07:33:53 2017 : Debug: (17) [pap] = noop Wed Mar 22 07:33:53 2017 : Debug: (17) } # authorize = updated Wed Mar 22 07:33:53 2017 : Debug: (17) Found Auth-Type = eap Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) authenticate { Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: calling eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Expiring EAP session with state 0xb44ea59dbc47bc85 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Finished EAP session with state 0x1c722cc11d7a36d7 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Previous EAP request found for state 0x1c722cc11d7a36d7, released from the list Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Peer sent packet with method EAP MSCHAPv2 (26) Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Calling submodule eap_mschapv2 to process data Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Success (code 3) ID 8 length 4 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Freeing handler Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = ok Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = ok Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing section post-auth from file /etc/raddb/sites-enabled/inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) post-auth { ... } # empty sub-section is ignored Wed Mar 22 07:33:53 2017 : Debug: (17) } # server inner-tunnel Wed Mar 22 07:33:53 2017 : Debug: (17) Virtual server sending reply Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Got tunneled reply RADIUS code 2 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Policy = Encryption-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Encryption-Types = RC4-40or128-bit-Allowed Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Send-Key = 0x08c8bbae983e14d7b8a0955f9179ce92 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: MS-MPPE-Recv-Key = 0x3762aac5c66a4ebf4733057f2b634292 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: EAP-Message = 0x03080004 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: User-Name = "userTest" Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Tunneled authentication was successful Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: SUCCESS Wed Mar 22 07:33:53 2017 : Debug: Ignoring cbtls_msg call with pseudo content type 256, version 0 Wed Mar 22 07:33:53 2017 : Debug: (17) eap_peap: Saving tunneled attributes for later Wed Mar 22 07:33:53 2017 : Debug: (17) eap: Sending EAP Request (code 1) ID 9 length 43 Wed Mar 22 07:33:53 2017 : Debug: (17) eap: EAP session adding &reply:State = 0x541acf3e5c13d64e Wed Mar 22 07:33:53 2017 : Debug: (17) modsingle[authenticate]: returned from eap (rlm_eap) Wed Mar 22 07:33:53 2017 : Debug: (17) [eap] = handled Wed Mar 22 07:33:53 2017 : Debug: (17) } # authenticate = handled Wed Mar 22 07:33:53 2017 : Debug: (17) Using Post-Auth-Type Challenge Wed Mar 22 07:33:53 2017 : Debug: (17) Post-Auth-Type sub-section not found. Ignoring. Wed Mar 22 07:33:53 2017 : Debug: (17) # Executing group from file /etc/raddb/sites-enabled/default Wed Mar 22 07:33:53 2017 : Debug: (17) session-state: Nothing to cache Wed Mar 22 07:33:53 2017 : Debug: (17) Sent Access-Challenge Id 8 from 10.41.110.86:1812 to 10.41.17.64:1042 length 0 Wed Mar 22 07:33:53 2017 : Debug: (17) EAP-Message = 0x0109002b1900170301002040009148da66c66e92399186be36b8b9bfb2 dd86e5e250997e63aa0d31227eff Wed Mar 22 07:33:53 2017 : Debug: (17) Message-Authenticator = 0x00000000000000000000000000000000 Wed Mar 22 07:33:53 2017 : Debug: (17) State = 0x541acf3e5c13d64e560d7f91490adef3 Wed Mar 22 07:33:53 2017 : Debug: (17) Finished request Wed Mar 22 07:33:53 2017 : Debug: (8) Cleaning up request packet ID 8 with timestamp +7 Wed Mar 22 07:33:53 2017 : Debug: (9) Cleaning up request packet ID 0 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (10) Cleaning up request packet ID 1 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (11) Cleaning up request packet ID 2 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (12) Cleaning up request packet ID 3 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (13) Cleaning up request packet ID 4 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (14) Cleaning up request packet ID 5 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (15) Cleaning up request packet ID 6 with timestamp +10 Wed Mar 22 07:33:53 2017 : Debug: (7) Cleaning up request packet ID 7 with timestamp +3 Wed Mar 22 07:33:53 2017 : Debug: Waking up in 4.9 seconds. Wed Mar 22 07:33:58 2017 : Debug: (17) Cleaning up request packet ID 8 with timestamp +14 Wed Mar 22 07:33:58 2017 : Debug: Waking up in 1.8 seconds. Wed Mar 22 07:34:00 2017 : Debug: (16) Cleaning up request packet ID 7 with timestamp +10 Wed Mar 22 07:34:00 2017 : Info: Ready to process requests