Questions tagged [eap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

EAP-SIM authentication doesn't work on windows server

i'm creating a wireless network and i need to authenticate the users with EAP-SIM, i create a user with the domain of 3gpp, but when the user authenticate he cant and in the log i recive a reason-code ...
user avatar
  • 101
0 votes
0 answers
37 views

802.1x EAP-TLS certificates protection

I am trying to configure the network in my small office so that only specific devices can connect to the Ethernet ports. I have read that it is best to use 802.1x and EAP-TLS as the most secure method....
user avatar
  • 105
0 votes
0 answers
136 views

Error code 0x90090331 - Explicit EAP Failure

Can anyone direct me to a reason for an Explicit EAP Failure with Error Code 0x90090331? Evidently, the error code is not on the internet. I have been troubleshooting some enterprise wireless issues ...
user avatar
0 votes
0 answers
141 views

Kerberos Works If Previously Not Pre-Authorized

I'm moving an application from WebLogic to JBoss EAP 6.4 and I almost have it working. The issue is that I can only get Kerberos authentication to work if I play with the isInitiator property in my ...
user avatar
1 vote
0 answers
630 views

802.1x NPS Machine authentication

We are trying to implement 802.1x to authenticate wirelless users (Aruba Controller) through RADIUS (Windows server 2019 NPS), For mobile phones and guests devices, we have successfully configured the ...
user avatar
0 votes
1 answer
49 views

Is there exist in a market some usb->ethernet->wifi combo dongle?

I have a USB-ended device which I want to connect to Enterprise Wireless network (EAP/TLS via FreeRadius). Is there any device in a market which can act as a WiFi client with EAP/TLS possibility? Now ...
user avatar
  • 101
0 votes
0 answers
211 views

Wireless EAP / Freeradius, is there a way to check Mac Address in LDAP?

So we have EAP-PEAP over MSCHAP working. What I'd like to do is have a MAC Address check, for the purpose of making sure people aren't putting their credentials into random devices. I know SCEP would ...
user avatar
0 votes
1 answer
398 views

Radius authentication does not work in Strongswan, when comming from a Windows VPN client?

My strongswan VPN server is authenticating VPN clients against a local Freeradius server. All user logings is proxied to remote radius server, that validates users against a Samba Active Directory ...
user avatar
3 votes
2 answers
2k views

EAP / MSCHAPv2 authentications fails (only) on Windows with custom authenticator

I have a project that involves custom client authentication for the StrongSwan IKEv2 server implementation on Linux. I am running: StrongSwan 5.4.0 with eap-radius plugin Currently, we use FreeRadius ...
user avatar
  • 31
0 votes
1 answer
283 views

Can a Linux box be configured with IEEE 802.1x while grabbing the info from a Windows box?

A managed Windows device can join the wired network of my corporate company, while a personal Linux one can't. As far as I understand, this is possible thanks to IEEE 802.1x standard. Looking at the ...
user avatar
0 votes
1 answer
2k views

How to configure FreeRADIUS with EAP-TLS and group-based authorization?

I configured FreeRADIUS to use EAP-TLS for certificate based authentication (self-signed certificates). Authentication works fine, except that I'd like to add group-based authorization. More ...
user avatar
0 votes
1 answer
828 views

How to configure FreeRADIUS for use with strongSwan group selection?

Building a VPN service with strongSwan, I need to distinguish between several groups of users where each group is assigned a certain subnet with certain permissions (i.e. "group x" has access only to ...
user avatar
0 votes
1 answer
166 views

Requesting access to a Radius server after having requested a previous (succeful) access to another Radius server

I don't know if this idea is non-sense but I was wondering if it was possible. I have a FreeRadius server backed by a LDAP server with uses EAP-TTLS (that is, username+password) to authenticate. So ...
user avatar
  • 135
0 votes
1 answer
5k views

MikroTik EAP-TLS WiFi Config using Certificates

What are the upsides and downsides of using EAP-TLS authentication with certificates for WiFi client connections? How is this superior than just using standard WPA2 password authentication? How do I ...
user avatar
  • 325
1 vote
1 answer
80 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
user avatar
1 vote
0 answers
911 views

FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow

I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate. ...
user avatar
2 votes
0 answers
706 views

Wired 802.1x on Windows 10 1803 isn't utilizing cache

So I’ve been trying to resolve 802.1x Wired authentication issues for quite some time now with limited success. The environment is based on Server 2012, Enterasys NAC using EAP-TLS1.2, with a ...
user avatar
1 vote
1 answer
2k views

Is it ok to use PAP with TTLS on radius server?

We have deployed Radius server ( Freeradius 3.x ) and connected it to our LDAP database (ForgeRock OpenDJ). We have successfully configured EAP-TTLS with valid certificates and set it as default ...
user avatar
  • 137
1 vote
1 answer
334 views

vpn connection to an azure virtual network

I have to connect to a Azure VNet, Which uses a certificate to authenticate that has been provided to me. When i try to connect to the VNet i get below error The Extensible Authentication Protocol ...
user avatar
  • 111
2 votes
0 answers
570 views

Run DHCP only after wpa_supplicant has connected (wired 802.1x)

I have a network here that uses 802.1x on the wired network to authenticate for greater privilege, BUT without (or "before") auth will place the machine in a default/quarantine network. For good luck, ...
user avatar
  • 121
1 vote
1 answer
1k views

Strongswan IKEv2 auth - pubkey and EAP

I'am trying to setup strongswan with pubkey and EAP authentication. To login users need to have certificate and valid credentials. My certificate is ok. I tested pubkey auth and it was ok, also EAP ...
user avatar
1 vote
1 answer
4k views

How to enable 802.1x EAP-TTLS with PAP in Windows 7?

By default, Windows 7 doesn't support EAP-TTLS authentication method natively. If I enable IEEE 802.1X authentication in Windows 7, I can see only two authentication methods: Microsoft smart cards or ...
user avatar
2 votes
1 answer
2k views

How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?

I am using eap-mschapv2 as an authentication method. It requires to store plain text passwords in ipsec.secrets. I.e. I have a password like this: user : EAP "mypassword" I want to use something ...
user avatar
  • 683
1 vote
0 answers
417 views

Freeradius Proxy eap-mschapv2 auth to non-eap Radius server

I'm using strongswan 5.6.0 & Freeradius 3.0.13 on CentOS7 as vpn server - Strongswan send radius requests to freeradius - freeradius proxy all request to another Radius Server that not support EAP ...
user avatar
0 votes
1 answer
944 views

JBoss EAP XA datasource with MDB failing

I have an MDB running that is posting data to an oracle db. XA data source configured as: <xa-datasource jndi-name="java:/jdbc/HIF-BannerPU" pool-name="HIF-BannerPU" enabled="true" spy="true" use-...
user avatar
0 votes
1 answer
3k views

Missing raddb folder

Various tutorials on setting up a freeRADIUS server refers to the eap.conf file in the /etc/raddb folder. However when i install freeRADIUS on my ubuntu server, the eap.conf file are found in /etc/...
user avatar
  • 103
2 votes
1 answer
7k views

Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x

I'm using FreeRadius with a Ubitquiti WiFi AP with 802.1x auth using EAP-TLS (mutual client/server cert based auth). This is working well for static VLANs (i.e. specified on the AP). I'd like to ...
user avatar
1 vote
0 answers
521 views

802.1x Wifi with NPS Server, using EAP-PEAP and a certificate for Authentication

I don't know if what I am trying to do is possible but here we go. I have a bunch of iPad's that I am going to supervise before they go on to my network. The iPad's will connect to the wifi via 802....
user avatar
  • 255
0 votes
1 answer
2k views

freeradius gives "no shared cipher" for windows 10 client

I have a working configuration of 802.1X authentification on my switch. The radius server is a freeradius instance with EAP-TLS configured. Everything works fine on linux (and android devices), but ...
user avatar
0 votes
1 answer
36 views

Unable to access server using remote desktop and detect access point in controller software at the same time

I have following topology: I am not a networking expert but somehow using the help of the Internet I was able to successful configure my topology so that I can access the Server remotely from any ...
user avatar
5 votes
2 answers
875 views

pfSense - IKEv2 with EAP-RADIUS: Any fallback option if the RADIUS server is down?

I'm deploying an IKEv2 VPN authenticating against a RADIUS service within a pfSense 2.3-RELEASE box. But I'm afraid of the complications of this approach when the RADIUS server is down. Since the ...
user avatar
1 vote
1 answer
598 views

Windows cannot connect to Enterprise WPA2 WiFi access point with EAP-TTLS PAP authentication using freeradius

I was working on having an Enterprise WiFi access point where my clients need to enter username and password (which are in OpenLDAP directory), using AES, TTLS PAP. I setup my freeradius according to ...
user avatar
2 votes
1 answer
2k views

EAP-TLS for Wireless with Active Directory

My question is more from a conceptual point of view, rather than implementation (even though I'm asking about proprietary protocols and products). Assuming I have users and credentials set up in my ...
user avatar
1 vote
1 answer
1k views

802.1x Login Window profile fails because it "can't prompt for missing properties"

I'm trying to configure a TTLS 802.1x Login Window profile on OS X 10.10.1 Yosemite. The profile has been installed (via MDM) and the login window now shows (above the username/password input boxes) ...
user avatar
  • 392
3 votes
0 answers
167 views

JBoss EAP 6.2 high availability without HTTP server

i'm looking for some solution to make a Jboss Cluster ( 2 nodes ) in H.A. ( 1 live, 1 backup) but i don't want to use a third element ( machine, service or whatever ). Most configuration I found uses ...
user avatar
0 votes
1 answer
6k views

EAP-PWD with FreeRADIUS 3

I'm trying to setup EAP-PWD using FreeRADIUS 3. However, I can't get it to work and documentation is virtually non-existent. Thus, I don't know whether the problem I'm running into is a ...
user avatar
  • 375
1 vote
1 answer
435 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
user avatar
  • 25
0 votes
0 answers
356 views

EAP-TLS Passthrough from pppd to Radius?

I am setting up an IPSec+L2TP VPN for a couple of Windows boxes connecting to a Debian 7.6 (Wheezy) machine running ipsec tools and xl2tpd/pppd. Client authentication via mschapv2 works well enough; ...
user avatar
  • 1
3 votes
1 answer
2k views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
user avatar
  • 33
0 votes
1 answer
544 views

RADIUS authentication requests not relayed to RADIUS server

I am trying to set up a RADIUS server for 802.1x NAC over a Cisco IE 3000 Network Switch, using freeRadius to implement it. I know the switch knows where the RADIUS server is because I set up the ...
user avatar
  • 11
3 votes
1 answer
1k views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, or ...
user avatar
  • 374
0 votes
1 answer
182 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
user avatar
0 votes
1 answer
269 views

LEAP vs EAP/TLS?

I am given a choice between: LEAP Wireless Client ID 802.1x (EAP/TLS) Wireless Client ID (Digital Certificates) To connect to a wireless network. What are the differences? Which one would you ...
user avatar
  • 175
0 votes
1 answer
928 views

JBoss AS EAP versions - What parts of EAP source code are closed source?

Question about the source code for JBoss EAP versions 4 5 or 6. Let's say we decided to purchase JBoss EAP 6 from RedHat. Can we still run maven to build JBoss EAP version? Are there closed source ...
user avatar
5 votes
2 answers
5k views

What should I use instead of MS-CHAP v2?

There's a new tool and service that makes it very easy to break MS-CHAP v2, which is used to secure VPNs. A good summary of the attach against MS-CHAP can be found at Ars Technica. Here's the way I ...
user avatar
  • 2,453
5 votes
3 answers
33k views

Troubleshooting Windows EAP/RADIUS connectivity issues

So, I guess the short version of the question is: I'm unable to get clients to connect to an enterprise-WPA wireless network after setting up a "new" NPS server and a new CA. After I manually ...
user avatar
  • 53.3k
3 votes
1 answer
5k views

Auth-Type :- Reject in RADIUS users file matches inner tunnel request but sends Access-Accept

I have WPA2 802.11x EAP authentication setup using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 talking to OpenLDAP, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via ...
user avatar
  • 30k