Questions tagged [eap]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
321 views

IPSec VPN Windows 10 Client Not Working - SOLVED

After 3 days of banging my head against the keyboard, I finally came up with a solution that allows my Windows 10 Professional built-in VPN client to connect to my Linux IPSec VPN server using EAP and ...
David Borgeson's user avatar
0 votes
1 answer
42 views

Can a WPA2-EAP network be created with consumer hardware for testing purposes?

We are working on the firmware of some device containing a WiFi SoC. (The firmware of the SoC is not modified by us.) Our customer now wants support for WPA2-EAP because the WiFi chip seems to have ...
Martin Rosenau's user avatar
0 votes
0 answers
670 views

SSL Error with EAP-TLS FreeRadius

My RADIUS Server is configured for EAP-TLS. I have a valid Server Certificate, Private Key and Fullchain file. When testing the authentication with a Client Certificate using eapol_test i get the ...
user20984154's user avatar
1 vote
2 answers
409 views

FreeRADIUS keeps complaining about TLS 1.0/1.1, despite tls_min_version setting has been set to 1.2

I'm implementing EAP-TTLS with FreeRADIUS 3.0.21. Devices are able to connect, server is running. However, FreeRADIUS complains about TLS 1.0/1.1 are still available in its starting log messages. Here'...
Václav's user avatar
  • 111
1 vote
0 answers
490 views

How to configure MACSEC Key Agreement (MKA) with hostapd & wpasupplicant?

I'm trying to setup MKA between some clients (using wpa_supplicant) and an authenticator (using hostapd). Additionally I have a RADIUS server(using FreeRADIUS) that is going to be handling the ...
A. Trevelyan's user avatar
1 vote
0 answers
2k views

802.1x NPS Machine authentication

We are trying to implement 802.1x to authenticate wirelless users (Aruba Controller) through RADIUS (Windows server 2019 NPS), For mobile phones and guests devices, we have successfully configured the ...
Oualid ZAKOUR's user avatar
0 votes
1 answer
77 views

Is there exist in a market some usb->ethernet->wifi combo dongle?

I have a USB-ended device which I want to connect to Enterprise Wireless network (EAP/TLS via FreeRadius). Is there any device in a market which can act as a WiFi client with EAP/TLS possibility? Now ...
A. Petrov's user avatar
  • 101
0 votes
0 answers
560 views

Wireless EAP / Freeradius, is there a way to check Mac Address in LDAP?

So we have EAP-PEAP over MSCHAP working. What I'd like to do is have a MAC Address check, for the purpose of making sure people aren't putting their credentials into random devices. I know SCEP would ...
Jonathan S. Fisher's user avatar
0 votes
1 answer
975 views

Radius authentication does not work in Strongswan, when comming from a Windows VPN client?

My strongswan VPN server is authenticating VPN clients against a local Freeradius server. All user logings is proxied to remote radius server, that validates users against a Samba Active Directory ...
Lasse Michael Mølgaard's user avatar
3 votes
2 answers
4k views

EAP / MSCHAPv2 authentications fails (only) on Windows with custom authenticator

I have a project that involves custom client authentication for the StrongSwan IKEv2 server implementation on Linux. I am running: StrongSwan 5.4.0 with eap-radius plugin Currently, we use FreeRadius ...
Domokun's user avatar
  • 31
0 votes
1 answer
508 views

Can a Linux box be configured with IEEE 802.1x while grabbing the info from a Windows box?

A managed Windows device can join the wired network of my corporate company, while a personal Linux one can't. As far as I understand, this is possible thanks to IEEE 802.1x standard. Looking at the ...
Patrick Allaert's user avatar
0 votes
1 answer
2k views

How to configure FreeRADIUS with EAP-TLS and group-based authorization?

I configured FreeRADIUS to use EAP-TLS for certificate based authentication (self-signed certificates). Authentication works fine, except that I'd like to add group-based authorization. More ...
j3141592653589793238's user avatar
0 votes
1 answer
1k views

How to configure FreeRADIUS for use with strongSwan group selection?

Building a VPN service with strongSwan, I need to distinguish between several groups of users where each group is assigned a certain subnet with certain permissions (i.e. "group x" has access only to ...
j3141592653589793238's user avatar
0 votes
1 answer
272 views

Requesting access to a Radius server after having requested a previous (succeful) access to another Radius server

I don't know if this idea is non-sense but I was wondering if it was possible. I have a FreeRadius server backed by a LDAP server with uses EAP-TTLS (that is, username+password) to authenticate. So ...
Osqui's user avatar
  • 135
0 votes
1 answer
8k views

MikroTik EAP-TLS WiFi Config using Certificates

What are the upsides and downsides of using EAP-TLS authentication with certificates for WiFi client connections? How is this superior than just using standard WPA2 password authentication? How do I ...
F1Linux's user avatar
  • 405
1 vote
1 answer
86 views

WPA2 Enterprise: no risks for preconfigured clients when it comes to Rogue APs?

We are using, as default, PEAP and MS-CHAPv2 as inner authentication. I was concerned with security risks when it comes to rogue APs but a colleague told me that there are no risks for preconfigured ...
Jade Kush's user avatar
1 vote
0 answers
2k views

FreeRADIUS default vs. inner-tunnel sites and EAP-TLS workflow

I am trying to setup EAP-TLS with FreeRADIUS and an IPA backend. I understand that a typical workflow is to authorize the user against LDAP first and then to authenticate the user using a certificate. ...
user3814483's user avatar
2 votes
0 answers
876 views

Wired 802.1x on Windows 10 1803 isn't utilizing cache

So I’ve been trying to resolve 802.1x Wired authentication issues for quite some time now with limited success. The environment is based on Server 2012, Enterasys NAC using EAP-TLS1.2, with a ...
Joshua Scott's user avatar
1 vote
1 answer
3k views

Is it ok to use PAP with TTLS on radius server?

We have deployed Radius server ( Freeradius 3.x ) and connected it to our LDAP database (ForgeRock OpenDJ). We have successfully configured EAP-TTLS with valid certificates and set it as default ...
pagep's user avatar
  • 137
1 vote
1 answer
396 views

vpn connection to an azure virtual network

I have to connect to a Azure VNet, Which uses a certificate to authenticate that has been provided to me. When i try to connect to the VNet i get below error The Extensible Authentication Protocol ...
Arvind's user avatar
  • 111
2 votes
0 answers
795 views

Run DHCP only after wpa_supplicant has connected (wired 802.1x)

I have a network here that uses 802.1x on the wired network to authenticate for greater privilege, BUT without (or "before") auth will place the machine in a default/quarantine network. For good luck, ...
Jim's user avatar
  • 121
1 vote
1 answer
2k views

Strongswan IKEv2 auth - pubkey and EAP

I'am trying to setup strongswan with pubkey and EAP authentication. To login users need to have certificate and valid credentials. My certificate is ok. I tested pubkey auth and it was ok, also EAP ...
user9443103's user avatar
1 vote
1 answer
5k views

How to enable 802.1x EAP-TTLS with PAP in Windows 7?

By default, Windows 7 doesn't support EAP-TTLS authentication method natively. If I enable IEEE 802.1X authentication in Windows 7, I can see only two authentication methods: Microsoft smart cards or ...
Yuanqiu Li's user avatar
2 votes
1 answer
2k views

How to store hashes in ipsec.secrets when using Strongswan with eap-mschapv2?

I am using eap-mschapv2 as an authentication method. It requires to store plain text passwords in ipsec.secrets. I.e. I have a password like this: user : EAP "mypassword" I want to use something ...
Oleksandr's user avatar
  • 763
1 vote
0 answers
525 views

Freeradius Proxy eap-mschapv2 auth to non-eap Radius server

I'm using strongswan 5.6.0 & Freeradius 3.0.13 on CentOS7 as vpn server - Strongswan send radius requests to freeradius - freeradius proxy all request to another Radius Server that not support EAP ...
Pedram Masoumi's user avatar
0 votes
1 answer
1k views

JBoss EAP XA datasource with MDB failing

I have an MDB running that is posting data to an oracle db. XA data source configured as: <xa-datasource jndi-name="java:/jdbc/HIF-BannerPU" pool-name="HIF-BannerPU" enabled="true" spy="true" use-...
OldProgrammer's user avatar
1 vote
1 answer
4k views

Missing raddb folder

Various tutorials on setting up a freeRADIUS server refers to the eap.conf file in the /etc/raddb folder. However when i install freeRADIUS on my ubuntu server, the eap.conf file are found in /etc/...
Morten's user avatar
  • 113
2 votes
1 answer
9k views

Freeradius VLAN assignment with EAP-TLS and WiFi 802.1x

I'm using FreeRadius with a Ubitquiti WiFi AP with 802.1x auth using EAP-TLS (mutual client/server cert based auth). This is working well for static VLANs (i.e. specified on the AP). I'd like to ...
user397220's user avatar
1 vote
0 answers
699 views

802.1x Wifi with NPS Server, using EAP-PEAP and a certificate for Authentication

I don't know if what I am trying to do is possible but here we go. I have a bunch of iPad's that I am going to supervise before they go on to my network. The iPad's will connect to the wifi via 802....
tyelford's user avatar
  • 255
0 votes
1 answer
2k views

freeradius gives "no shared cipher" for windows 10 client

I have a working configuration of 802.1X authentification on my switch. The radius server is a freeradius instance with EAP-TLS configured. Everything works fine on linux (and android devices), but ...
Alexander Sergeyev's user avatar
0 votes
1 answer
45 views

Unable to access server using remote desktop and detect access point in controller software at the same time

I have following topology: I am not a networking expert but somehow using the help of the Internet I was able to successful configure my topology so that I can access the Server remotely from any ...
Aishwarya Shiva's user avatar
5 votes
2 answers
1k views

pfSense - IKEv2 with EAP-RADIUS: Any fallback option if the RADIUS server is down?

I'm deploying an IKEv2 VPN authenticating against a RADIUS service within a pfSense 2.3-RELEASE box. But I'm afraid of the complications of this approach when the RADIUS server is down. Since the ...
Vinícius Ferrão's user avatar
1 vote
1 answer
747 views

Windows cannot connect to Enterprise WPA2 WiFi access point with EAP-TTLS PAP authentication using freeradius

I was working on having an Enterprise WiFi access point where my clients need to enter username and password (which are in OpenLDAP directory), using AES, TTLS PAP. I setup my freeradius according to ...
Mohammed Noureldin's user avatar
2 votes
1 answer
2k views

EAP-TLS for Wireless with Active Directory

My question is more from a conceptual point of view, rather than implementation (even though I'm asking about proprietary protocols and products). Assuming I have users and credentials set up in my ...
AndreCruz's user avatar
1 vote
1 answer
1k views

802.1x Login Window profile fails because it "can't prompt for missing properties"

I'm trying to configure a TTLS 802.1x Login Window profile on OS X 10.10.1 Yosemite. The profile has been installed (via MDM) and the login window now shows (above the username/password input boxes) ...
eggyal's user avatar
  • 412
3 votes
0 answers
172 views

JBoss EAP 6.2 high availability without HTTP server

i'm looking for some solution to make a Jboss Cluster ( 2 nodes ) in H.A. ( 1 live, 1 backup) but i don't want to use a third element ( machine, service or whatever ). Most configuration I found uses ...
Stefano R.'s user avatar
1 vote
1 answer
7k views

EAP-PWD with FreeRADIUS 3

I'm trying to setup EAP-PWD using FreeRADIUS 3. However, I can't get it to work and documentation is virtually non-existent. Thus, I don't know whether the problem I'm running into is a ...
Compizfox's user avatar
  • 394
1 vote
1 answer
582 views

EAP-TLS: is it possible eavesdropping when sharing client certificate?

I want to know how to share a network of WPA2 enterprise with EAP-TLS, authenticating users with a common certificate. They share the same certificate. I'm afraid they can monitor each other. Is ...
jumeno's user avatar
  • 25
0 votes
0 answers
384 views

EAP-TLS Passthrough from pppd to Radius?

I am setting up an IPSec+L2TP VPN for a couple of Windows boxes connecting to a Debian 7.6 (Wheezy) machine running ipsec tools and xl2tpd/pppd. Client authentication via mschapv2 works well enough; ...
canut's user avatar
  • 1
4 votes
1 answer
2k views

Why does Windows CA Server issue multiple certificates for the same user?

I am currently implementing an EAP/TLS WIFI implementation to replace our EAP/MSCHAP2 wifi implementation. I am using Windows Server 2008 and I've installed a certificate authority. User certificates ...
gerwout's user avatar
  • 43
0 votes
1 answer
607 views

RADIUS authentication requests not relayed to RADIUS server

I am trying to set up a RADIUS server for 802.1x NAC over a Cisco IE 3000 Network Switch, using freeRadius to implement it. I know the switch knows where the RADIUS server is because I set up the ...
Alex's user avatar
  • 11
3 votes
1 answer
1k views

Is using EAP-MD5 in strongSwan a security risk?

Quoting Wikipedia: It offers minimal security; the MD5 hash function is vulnerable to dictionary attacks, and does not support key generation, which makes it unsuitable for use with dynamic WEP, or ...
reish's user avatar
  • 384
0 votes
1 answer
197 views

What decides what tunnels inside EAP-TTLS?

If EAP-TTLS is a EAP method that establishes a TLS tunnel, what goes in the tunnel? It could be another EAP method, but it could also be PAP. What decides? The server, the supplicant, or do they ...
Phil Frost's user avatar
0 votes
1 answer
294 views

LEAP vs EAP/TLS?

I am given a choice between: LEAP Wireless Client ID 802.1x (EAP/TLS) Wireless Client ID (Digital Certificates) To connect to a wireless network. What are the differences? Which one would you ...
cnandreu's user avatar
  • 175
0 votes
1 answer
957 views

JBoss AS EAP versions - What parts of EAP source code are closed source?

Question about the source code for JBoss EAP versions 4 5 or 6. Let's say we decided to purchase JBoss EAP 6 from RedHat. Can we still run maven to build JBoss EAP version? Are there closed source ...
Nicholas DiPiazza's user avatar
5 votes
2 answers
6k views

What should I use instead of MS-CHAP v2?

There's a new tool and service that makes it very easy to break MS-CHAP v2, which is used to secure VPNs. A good summary of the attach against MS-CHAP can be found at Ars Technica. Here's the way I ...
Knox's user avatar
  • 2,491
5 votes
3 answers
36k views

Troubleshooting Windows EAP/RADIUS connectivity issues

So, I guess the short version of the question is: I'm unable to get clients to connect to an enterprise-WPA wireless network after setting up a "new" NPS server and a new CA. After I manually ...
HopelessN00b's user avatar
3 votes
1 answer
6k views

Auth-Type :- Reject in RADIUS users file matches inner tunnel request but sends Access-Accept

I have WPA2 802.11x EAP authentication setup using FreeRADIUS 2.1.8 on Ubuntu 10.04.4 talking to OpenLDAP, and can successfully authenticate using PEAP/MSCHAPv2, TTLS/MSCHAPv2 and TTLS/PAP (both via ...
mgorven's user avatar
  • 31k