FreeRadius with EAP-TLS on windows 7, certs installed but not sent out.
HI, I'm using EAP-TLS to do WI-FI authentication, I setup WPA2 enterprise + AES(CCMP) on my AP, and shared key on clients.conf of radius. I also used make ca.pem, make server.pem and make client.pem on /etc/raddb/certs, and copied ca.der and client.pem(rename to client.crt) on windows7, installed ca.der on 'trusted root certification authorities' and client.crt on 'personal' respectively. When I tried to connect the SSID of that AP, nothing was sent out to radius server, no Access-Request, I also used WireShark to capture packets of my wireless NIC, nothing at all. Looks it keeps trying to connect this SSID, and pops up messages that certificate is required... please contact your IT admins.etc, thing like that. My wireless NIC works as I tried to connect another SSID with password, wireshark showed inbound and outbound packets. So any idea why win7 does not send out any packet? Anything is wrong? I used scripts of certs/ Makefile, so extended key usage required by windows is added. Thanks,
On Wed, 2018-12-12 at 19:41 +0800, luckydog xf wrote:
When I tried to connect the SSID of that AP, nothing was sent out to radius server
So the AP isn't configured correctly.
So any idea why win7 does not send out any packet?
Windows doesn't contact the RADIUS server. The AP does. -- Matthew
I used eapol_test with certificates, it works like a charm. So I guess certificate created by `make xxx` may be not compatible with requirement of windows. On Wed, Dec 12, 2018 at 7:41 PM luckydog xf <luckydogxf@gmail.com> wrote:
HI,
I'm using EAP-TLS to do WI-FI authentication, I setup WPA2 enterprise + AES(CCMP) on my AP, and shared key on clients.conf of radius.
I also used make ca.pem, make server.pem and make client.pem on /etc/raddb/certs, and copied ca.der and client.pem(rename to client.crt) on windows7, installed ca.der on 'trusted root certification authorities' and client.crt on 'personal' respectively.
When I tried to connect the SSID of that AP, nothing was sent out to radius server, no Access-Request, I also used WireShark to capture packets of my wireless NIC, nothing at all.
Looks it keeps trying to connect this SSID, and pops up messages that certificate is required... please contact your IT admins.etc, thing like that.
My wireless NIC works as I tried to connect another SSID with password, wireshark showed inbound and outbound packets.
So any idea why win7 does not send out any packet? Anything is wrong?
I used scripts of certs/ Makefile, so extended key usage required by windows is added.
Thanks,
I know AP is a NAS , but why there is nothing sent out on my wireless NIC, as I captured it by wireshark. At lease it should send out something basic... On Wed, Dec 12, 2018 at 7:46 PM luckydog xf <luckydogxf@gmail.com> wrote:
I used eapol_test with certificates, it works like a charm. So I guess certificate created by `make xxx` may be not compatible with requirement of windows.
On Wed, Dec 12, 2018 at 7:41 PM luckydog xf <luckydogxf@gmail.com> wrote:
HI,
I'm using EAP-TLS to do WI-FI authentication, I setup WPA2 enterprise + AES(CCMP) on my AP, and shared key on clients.conf of radius.
I also used make ca.pem, make server.pem and make client.pem on /etc/raddb/certs, and copied ca.der and client.pem(rename to client.crt) on windows7, installed ca.der on 'trusted root certification authorities' and client.crt on 'personal' respectively.
When I tried to connect the SSID of that AP, nothing was sent out to radius server, no Access-Request, I also used WireShark to capture packets of my wireless NIC, nothing at all.
Looks it keeps trying to connect this SSID, and pops up messages that certificate is required... please contact your IT admins.etc, thing like that.
My wireless NIC works as I tried to connect another SSID with password, wireshark showed inbound and outbound packets.
So any idea why win7 does not send out any packet? Anything is wrong?
I used scripts of certs/ Makefile, so extended key usage required by windows is added.
Thanks,
On Dec 12, 2018, at 6:49 AM, luckydog xf <luckydogxf@gmail.com> wrote:
I know AP is a NAS , but why there is nothing sent out on my wireless NIC, as I captured it by wireshark. At lease it should send out something basic...
If the Windows system isn't sending packets, then it's not a RADIUS problem. We can only help with RADIUS problems. Alan DeKok.
:) So anything wrong with my setup? Or anything that I missed out. It's pretty weird. I used the same certs with eapol_test, it does work. While I copied them and installed on windows, it didn't work. Maybe firewall of windows7 blocks traffics.... I'll take a look tomorrow. Thanks. On Wed, Dec 12, 2018 at 7:51 PM Alan DeKok <aland@deployingradius.com> wrote:
On Dec 12, 2018, at 6:49 AM, luckydog xf <luckydogxf@gmail.com> wrote:
I know AP is a NAS , but why there is nothing sent out on my wireless
NIC,
as I captured it by wireshark. At lease it should send out something basic...
If the Windows system isn't sending packets, then it's not a RADIUS problem. We can only help with RADIUS problems.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Dec 12, 2018, at 7:00 AM, luckydog xf <luckydogxf@gmail.com> wrote:
:) So anything wrong with my setup? Or anything that I missed out.
It's not a RADIUS problem. You were told this. We don't do Windows technical support here. Stop asking non-RADIUS questions on the FreeRADIUS list. Alan DeKok.
Sorry, I mean no offense, I just want to get problme solved. I used eap-peap-mschapv2 to prove that it has something to do with setup. Using eap-peap-mschapv2, before it's * successful *, nothing was send out through wireless NIC, either. The first packet is DHCP reqeust once it passes eap-peap-mschapv2 auth. And it has nothing to do with firewall of windows7. So I'm here to seek any adivce. Apologize if I did anythig wrong. On Wed, Dec 12, 2018 at 8:10 PM Alan DeKok <aland@deployingradius.com> wrote:
On Dec 12, 2018, at 7:00 AM, luckydog xf <luckydogxf@gmail.com> wrote:
:) So anything wrong with my setup? Or anything that I missed out.
It's not a RADIUS problem. You were told this. We don't do Windows technical support here.
Stop asking non-RADIUS questions on the FreeRADIUS list.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Try lots of time and make below conclusion for anyone who may run into the same situation reference. 1. NO traffic on Supplicant( win7) and NAS( AC/AP) UNLESS you setup eap correctly. That's expected. The first packet is DHCP request until you pass authentication. 2. Windows is nnlike Linux, it requires a combination of cert and private key, usually it's a p12 or pfx, That's the root cause of my problem. 3. {cadir}/certs is a great place and has tools generating certs that requires by windows. Don't ever try to use openssl CLI on your own, Freeradius's is good enough. 4. Extended Key Usage of cert for windows 7/10 is a must, and when you enable mutul authentication, make sure you install CA on *Trusted Root Certification Authorities store and select it.* check https://support.microsoft.com/en-us/help/814394/certificate-requirements-whe... 5. eapol_test is a good supplicant to test eap-tls.etc, pretty easy to setup. That's all. On Thu, Dec 13, 2018 at 11:52 AM luckydog xf <luckydogxf@gmail.com> wrote:
Sorry, I mean no offense, I just want to get problme solved.
I used eap-peap-mschapv2 to prove that it has something to do with setup.
Using eap-peap-mschapv2, before it's * successful *, nothing was send out through wireless NIC, either. The first packet is DHCP reqeust once it passes eap-peap-mschapv2 auth.
And it has nothing to do with firewall of windows7.
So I'm here to seek any adivce. Apologize if I did anythig wrong.
On Wed, Dec 12, 2018 at 8:10 PM Alan DeKok <aland@deployingradius.com> wrote:
On Dec 12, 2018, at 7:00 AM, luckydog xf <luckydogxf@gmail.com> wrote:
:) So anything wrong with my setup? Or anything that I missed out.
It's not a RADIUS problem. You were told this. We don't do Windows technical support here.
Stop asking non-RADIUS questions on the FreeRADIUS list.
Alan DeKok.
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (3)
-
Alan DeKok -
luckydog xf -
Matthew Newton