EAP-FAST seems not being widely used. The latest thread on this topic that I found is: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/073588... There it is mentioned, that: rlm_eap2 was removed from v3.0.x so if you're building 3.0.0 the module won't be available. As EAP-FAST could be used with the experimental rlm_eap2 : Does this mean, Freeradius 3.x does not support EAP FAST? Norbert Wegener
On Sep 9, 2015, at 8:30 AM, Wegener, Norbert <norbert.wegener@atos.net> wrote:
EAP-FAST seems not being widely used.
It's used in Cisco deployments. By people who buy ACS. Or ISE. Or whatever they call it these days.
The latest thread on this topic that I found is: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/073588...
There it is mentioned, that:
rlm_eap2 was removed from v3.0.x so if you're building 3.0.0 the module won't be available.
As EAP-FAST could be used with the experimental rlm_eap2 :
Does this mean, Freeradius 3.x does not support EAP FAST?
It doesn't support EAP-FAST. The code probably isn't hard to write. I've had some old (and bad) code sitting around for a while: $ ls ../avenda/modules/freeradius-114/src/modules/rlm_eap/types/rlm_eap_fast/ Makefile.in configure.in eap_fast_keys.c ... The code is *terrible* tho. I didn't have time to go fix it. Alan DeKok.
A Cisco guy told me, EAP-FAST is required when a Cisco AP shall be used with NEAT. Maybe this is not true and someone here knows it better? Norbert Wegener -----Original Message----- From: Freeradius-Users [mailto:freeradius-users-bounces+norbert.wegener=atos.net@lists.freeradius.org] On Behalf Of Alan DeKok Sent: Wednesday, September 09, 2015 3:31 PM To: FreeRadius users mailing list Subject: Re: EAP-FAST Support On Sep 9, 2015, at 8:30 AM, Wegener, Norbert <norbert.wegener@atos.net> wrote:
EAP-FAST seems not being widely used.
It's used in Cisco deployments. By people who buy ACS. Or ISE. Or whatever they call it these days.
The latest thread on this topic that I found is: http://lists.freeradius.org/pipermail/freeradius-users/2014-September/ 073588.html
There it is mentioned, that:
rlm_eap2 was removed from v3.0.x so if you're building 3.0.0 the module won't be available.
As EAP-FAST could be used with the experimental rlm_eap2 :
Does this mean, Freeradius 3.x does not support EAP FAST?
It doesn't support EAP-FAST. The code probably isn't hard to write. I've had some old (and bad) code sitting around for a while: $ ls ../avenda/modules/freeradius-114/src/modules/rlm_eap/types/rlm_eap_fast/ Makefile.in configure.in eap_fast_keys.c ... The code is *terrible* tho. I didn't have time to go fix it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Sep 9, 2015, at 10:41 AM, Wegener, Norbert <norbert.wegener@atos.net> wrote:
A Cisco guy told me, EAP-FAST is required when a Cisco AP shall be used with NEAT. Maybe this is not true and someone here knows it better?
No idea... Cisco has a history of making their products work "better" together. i.e. Making them *not* work with non-Cisco equipment. Alan DeKok.
On 9 Sep 2015, at 15:44, Alan DeKok <aland@deployingradius.com> wrote:
On Sep 9, 2015, at 10:41 AM, Wegener, Norbert <norbert.wegener@atos.net> wrote:
A Cisco guy told me, EAP-FAST is required when a Cisco AP shall be used with NEAT. Maybe this is not true and someone here knows it better?
No idea... Cisco has a history of making their products work "better" together. i.e. Making them *not* work with non-Cisco equipment.
Their docs pages say so... But I have no time to be fixing FAST code right now, so one of the list peeps will need to do it if they want FAST support back. Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS development team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2
Cisco sneak EAP-FAST and its derivatives into many of their proprietary systems. ..such as their TrustSec system. alan
There's also fun supporting TLS 1.2 for EAP-FAST if anybody actually wants to resurrect this EAP type: OpenSSL: Add SHA256 support in openssl_tls_prf() for TLSv1.2 http://w1.fi/cgit/hostap/commit/?id=16bc3b8935c3f37ea79ff511a36e77d52ab94da7 "This is needed when enabling TLSv1.2 support for EAP-FAST since the SSL_export_keying_material() call does not support the needed parameters for TLS PRF and the external-to-OpenSSL PRF needs to be used instead. " There likely to be issues with FreeRADIUS 2.2.x here therefore. (It may be worth ensuring only TLS 1.0 gets used for EAP-FAST in 2.2.9.) Regards, Nick
Hi,
There likely to be issues with FreeRADIUS 2.2.x here therefore. (It may be worth ensuring only TLS 1.0 gets used for EAP-FAST in 2.2.9.)
IIRC if you wanted to use FAST with v2.x you needed to use the EAP2 experimental module which then offloads everything to the hostapd libraries - so its uses THAT library stuff for all the TLS etc. given that we have no recent reports of anyone using that , successfully or unsuccessfully..... and anyone who does didnt heed the "DO NOT USE IT IN A PRODUCTION ENVIRONMENT" warning.... who knows!! thats why its not in 3.x :) alan
Hi,
Cool! :)
It's certainly not something I've ever wanted to touch!
I did have a go a while back (because things like Cisco TrustSec use EAP-FAST - though a variant) and also because I was checking out how 'fast' EAP-FAST was and issues with privisioning the PAC. but that was long ago and I've pretty much gone to EAP-TLS :-) alan
participants (6)
-
A.L.M.Buxey＠lboro.ac.uk -
Alan Buxey
-
Alan DeKok -
Arran Cudbard-Bell -
Nick Lowe -
Wegener, Norbert