We have the following setup at our company: a gateway PC with CentOS (gw), running Radius and some traffic filtering programs. All of our employees connect wirelessly, and we have a WPA2 Enterprise encryption in place. The users are in a MySQL database on the gw, and they have their user roles defined there - deciding which user has access to which SSID. We have 4 SSIDs (thus, 4 VLANs), and thus 4 user groups for now - each has its own rules about QoS, bandwidth limits etc.
The network works great, save for one issue - when the user mis-authenticates, he gets no feedback. The WiFi client (everyone is using iMacs and Macbooks, there's only a couple Windows/Linux boxes here in IT) gets stuck in some kind of limbo where he says he's connected, but has no valid IP and thus no internet access. Since MacOS remembers passwords by default, he concluded he was successfully connected and never asks for a password again. Which means anyone who made an invalid login gets stuck with it until they erase the remembered password from the archive. This, as you can imagine, is incredibly tedious for a rapidly growing company of 80+ people.
Our APs are WRT54GL with DD-WRT installed as firmware.
It seems as if the radius client on the AP doesn't send any proper feedback to the WiFi client on the employees' computers. Does anyone have any experience with this sort of setup? How would one fix this no-feedback issue? Would better APs be the answer? I've been looking at Cisco's WAP2000. The cost is not an issue.
This is the comment above mschapv2 in our eap.conf file:
# # This takes no configuration. # # Note that it is the EAP MS-CHAPv2 sub-module, not # the main 'mschap' module. # # Note also that in order for this sub-module to work, # the main 'mschap' module MUST ALSO be configured. # # This module is the *Microsoft* implementation of MS-CHAPv2 # in EAP. There is another (incompatible) implementation # of MS-CHAPv2 in EAP by Cisco, which FreeRADIUS does not # currently support. #