topic wpa_supplicant running EAP-TLS on ubuntu in Wireless

wpa_supplicant running EAP-TLS on ubuntu

Wes Schochet — Mon, 05 Jul 2021 18:26:16 GMT

Hi all-

5520 controller running 8.5.140 and a 3702 AP in local mode. I have other devices of various types concected to this SSID using EAP-TLS, so I am confident in the controller config (WPA2 Policy, WPA2 Encryption=AES, Authentication Key Management=802.1x)

I have a linux device that I am trying to connect via EAP-TLS. The deice is using wpa_supplicant. the config file is as follows:

network={
ssid="mySSID"
proto=RSN
key_mgmt=IEEE8021X
eap=TLS
scan_ssid=1
identity="myDevice"
ca_cert="/etc/certs/cacert.pem"
client_cert="/etc/certs/myDev.cer"
private_key="/etc/certs/myDevkey"
eapol_flags=3
}

The controller debug just shows the following:

*spamApTask3: Dec 16 09:53:46.861: b0:1f:81:d5:07:23 Association Failed on REAP AP BSSID ec:bd:1d:15:7b:d7 (slot 1), status 13 0 rsnie-osnie accept failed
*spamApTask1: Dec 16 09:53:52.260: b0:1f:81:d5:07:23 Association Failed on REAP AP BSSID 58:f3:9c:fb:a8:37 (slot 1), status 13 0 rsnie-osnie accept failed

Anyone have a config that works for wpa_supplicant and EAP-TLS?

Thanks

Re: wpa_supplicant running EAP-TLS on ubuntu

Mark Elsen — Mon, 16 Dec 2019 17:15:47 GMT

- You may be hitting a CCKM compliance issue ; check the following :

https://community.cisco.com/t5/wireless-and-mobility/ccx-devices-matrix-support/td-p/2726474

I also found a related bug report :

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf55570/?rfs=iqvred

Re: wpa_supplicant running EAP-TLS on ubuntu

Wes Schochet — Mon, 16 Dec 2019 18:39:33 GMT

I guess I don't understand how CCKM interacts with 802.1x. In my mind they are totally separate. What is the interaction there?

Re: wpa_supplicant running EAP-TLS on ubuntu

Dennis Bland — Wed, 25 Dec 2019 03:16:45 GMT

The setting "key_mgmt=IEEE8021X" in your wpa_supplicant.conf file is for WEP keys only. You mentioned you are using WPA2, so you should use the following:

key_mgmt=WPA-EAP

Also, if you don't want to be prompted for the private key password, you can add the following line under private_key:

private_key_passwd="password"

Dennis Bland

dB Performance Inc.

Re: wpa_supplicant running EAP-TLS on ubuntu

Wes Schochet — Tue, 31 Dec 2019 21:16:41 GMT

Thanks! That did the trick!