Subject: [78attendees] ietf.1x WiFi config

From: <[email-masked]>
Date: Mon, 26 Jul 2010 06:13:20 -0400

I have a several years-old Dell laptop with internal WiFi card that supports WPA, but not WPA2.

Here are the configuration settings that now have it working on the ietf.1x network:
	- Network authentication: WPA-Enterprise
	- EAP method: PEAP
	- Inner EAP method: MS-CHAP v2

Thanks,
--David
----------------------------------------------------
David L. Black, Distinguished Engineer
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

---

From: Chris Morrow <[email-masked]>
Date: Mon, 26 Jul 2010 06:45:23 -0400

as an aside... I fought some with ubuntu-lucid today and got on the wireless:
  (network manager promptiness)
  o wpa2/enterprise
  o PEAP
  o MSCHAPv2
  o emtpy anonymous-id
  o Username: 10-digit registration-id (from the registration email,
yes this is a circular dependency)
  o passwd: documented passwd

On the ietf-a.1x this config works for me, on Ubuntu-Lucid && Android (phone).

HTH,
-chris

On Mon, Jul 26, 2010 at 6:13 AM,  <[email-masked]> wrote:
> _______________________________________________
> 78attendees mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/78attendees
>

---

From: Mark Andrews <[email-masked]>
Date: Mon, 26 Jul 2010 20:59:58 +1000

this is what I have in wpa_supplicant.conf

network={
        ssid="ietf.1x"
        key_mgmt=WPA-EAP
        pairwise=TKIP
        identity="XXXXXXXXXX"
        password="ietf"
}

-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Derek Atkins <[email-masked]>
Date: Mon, 26 Jul 2010 07:01:59 -0400

> yes this is a circular dependency)

Note that:

1) You only need the first six (6) digits, and
2) Those six digits are printed on the back of your ID Badge.

> On the ietf-a.1x this config works for me, on Ubuntu-Lucid && Android (phone).

But yes, I did have to reset NetworkManager to PEAP to get it to work.

-derek

-- 
Derek Atkins
Senior Principal Software Engineer
PGP Corporation
Now part of Symantec

+1 617 623 3745 | [email-masked]

PGP Fingerprint:
0FEE 5EA1 FF22 E0C9 4FFE
631A 9232 FF93 1C80 1DB7

---

From: Jim Martin <[email-masked]>
Date: Mon, 26 Jul 2010 13:07:50 +0200

Thanks to both you and Chris. We'll make sure these get into the wiki, which is at noc.meeting.ietf.org. If others have successful configs that aren't already documented (ie, not for the Mac or vanilla Win XP/7) please send them!
	
	- Jim

---

From: Jim Martin <[email-masked]>
Date: Mon, 26 Jul 2010 13:11:11 +0200

> 2) Those six digits are printed on the back of your ID Badge.

	That's true. Due to some logistical issues, we've loaded both the first 6 digits (what's printed on the badge) or the full 10 digits (which is what's on your receipts/confirmation email) into the database. 

	Thanks to all for trying to use 802.1X!

	- Jim

---

From: Wilmer van der Gaast <[email-masked]>
Date: Mon, 26 Jul 2010 13:13:57 +0200

> this is what I have in wpa_supplicant.conf
Yeah, to my great surprise this (even without pairwise=) was enough to
get this stuff to work. :-) However, for a real sense of security
shouldn't the NOC also publish the certificate?

Wilmer v/d Gaast.

-- 
Wilmer van der Gaast, Traffic SRE/Google Public DNS team.
Google Ireland.

---

From: Ted Lemon <[email-masked]>
Date: Mon, 26 Jul 2010 04:26:09 -0700

> yes this is a circular dependency)

I just used the number on my badge--was that a mistake?   Seems to have worked... :')

---

From: Chris Morrow <[email-masked]>
Date: Mon, 26 Jul 2010 07:27:06 -0400

> 2) Those six digits are printed on the back of your ID Badge.

right, been there, tried that, failed all the way through IDR this
morning. 10 digits always works for me, 6 digits never did. (note that
I said the 10 digit one for a reason not related to me liking to type
:) )

---

From: Chris Morrow <[email-masked]>
Date: Mon, 26 Jul 2010 07:28:34 -0400

> I just used the number on my badge--was that a mistake?   Seems to have worked... :')

it's working for some folks, not others... I believe Jim/noc-folken
have some reasoning as to why this is the case.

-chris

---

From: Chris Elliott <[email-masked]>
Date: Mon, 26 Jul 2010 07:39:50 -0400

We can see what is happening, but we don't know why. It appears that for
some unix* devices that the AP is sending an identity request, the device is
appearing to send the identity back, but the AP is not seeing the packet at
the authenticator level. We are still debugging this issue.

Chris.

-- 
Chris Elliott
[email-masked]