topic Re: Radius and devices that dont support wpa2 enterprise in Wireless

Radius and devices that dont support wpa2 enterprise

ZedKay — Tue, 12 Jul 2022 06:01:32 GMT

Hello,

We are currently looking at setting up a radius server to connect our users/devices to the wireless network.

So far we have that part working for those devices that support wpa2 enterprise.

We have a few devices (TV etc) that do not support this authentication method.

We have tried a few things on our radius server to allow specific mac address (but the authentication requests do not appear to be making it through to the radius server)

We are using a freeradius server.

Hoping someone can shed some light - or point us in another direction.

Re: Radius and devices that dont support wpa2 enterprise

marek.golha — Tue, 12 Jul 2022 08:52:28 GMT

Hello ZedKay,

I am not sure if I understand the question correctly. You want to connect the TVs to the same WLAN which is using WPA2-ENT or you have created a new WLAN specifically for the devices which do not support WAP2-ENT?

Marek

Re: Radius and devices that dont support wpa2 enterprise

ZedKay — Tue, 12 Jul 2022 08:59:52 GMT

Hi,

looking to connect the devices to the same WLAN as the wpa2-ent devices.

Re: Radius and devices that dont support wpa2 enterprise

GreenMan — Tue, 12 Jul 2022 10:41:21 GMT

You can't do this on the same SSID - the 'MAC-based access control (no encryption)' and 'Enterprise with my RADIUS server' config options are mutually exclusive. Remember that, as per the description, the MAC authentication option does not result in an encrypted WLAN session between the client and the AP as Enterprise 802.1x does. I'd recommend you look at using Identity PSK with RADIUS (assuming you;re using a reasonably recent MR access point model and firmware). iPSK combines WPA2-PSK authentication / encryption with a check of the client MAC address. https://documentation.meraki.com/MR/Encryption_and_Authentication/IPSK_with_RADIUS_Authentication

Note that this would still be a separate SSID to your Enterprise 802.1x SSID - but you should be able to use the same RADIUS server for both.

Re: Radius and devices that dont support wpa2 enterprise

ZedKay — Tue, 12 Jul 2022 11:17:43 GMT

Thanks GreenMan.

We are using iPSK at the moment but without radius.

This is what I was trying to achieve:

https://wiki.freeradius.org/guide/mac-auth#plain-mac-auth_raddb-policy-conf

Re: Radius and devices that dont support wpa2 enterprise

BlakeRichardson — Wed, 13 Jul 2022 07:55:43 GMT

@ZedKay Your only option is a second SSID with an authentication method that supports said devices, this SSID can be on the same VLAN as your exisiting wifi network.

I run the same setup in my workplace.

Re: Radius and devices that dont support wpa2 enterprise

Philip D'Ath — Wed, 13 Jul 2022 10:18:33 GMT

I'm with @BlakeRichardson . Don't add complexity unless it is required. Add a second SSID.