cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1145
Views
5
Helpful
4
Replies
Highlighted
Beginner

wpa_supplicant running EAP-TLS on ubuntu

Hi all-

 

5520 controller running 8.5.140 and a 3702 AP in local mode.  I have other devices of various types concected to this SSID using EAP-TLS, so I am confident in the controller config (WPA2 Policy, WPA2 Encryption=AES, Authentication Key Management=802.1x)

I have a linux device that I am trying to connect via EAP-TLS.  The deice is using wpa_supplicant.  the config file is as follows:

 

network={
ssid="mySSID"
proto=RSN
key_mgmt=IEEE8021X
eap=TLS
scan_ssid=1
identity="myDevice"
ca_cert="/etc/certs/cacert.pem"
client_cert="/etc/certs/myDev.cer"
private_key="/etc/certs/myDevkey"
eapol_flags=3
}

 

The controller debug just shows the following:

 

*spamApTask3: Dec 16 09:53:46.861: b0:1f:81:d5:07:23 Association Failed on REAP AP BSSID ec:bd:1d:15:7b:d7 (slot 1), status 13 0 rsnie-osnie accept failed
*spamApTask1: Dec 16 09:53:52.260: b0:1f:81:d5:07:23 Association Failed on REAP AP BSSID 58:f3:9c:fb:a8:37 (slot 1), status 13 0 rsnie-osnie accept failed

 

Anyone have a config that works for wpa_supplicant and EAP-TLS? 

 

Thanks

 

4 REPLIES 4
Highlighted
VIP Advocate

 

 - You may be hitting a CCKM compliance issue ; check the following :

                   https://community.cisco.com/t5/wireless-and-mobility/ccx-devices-matrix-support/td-p/2726474

 I also found a related bug report :

              https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvf55570/?rfs=iqvred

 M.

Highlighted

I guess I don't understand how CCKM interacts with 802.1x. In my mind they are totally separate. What is the interaction there?
Highlighted
Beginner

The setting "key_mgmt=IEEE8021X" in your wpa_supplicant.conf file is for WEP keys only.  You mentioned you are using WPA2, so you should use the following:

 

key_mgmt=WPA-EAP

 

Also, if you don't want to be prompted for the private key password, you can add the following line under private_key:

 

private_key_passwd="password"

 

Dennis Bland

dB Performance Inc.

 

Highlighted

Thanks! That did the trick!