Setting up Photon/P1 on WPA Enterprise (0.7.0)

BDub · June 29, 2017, 4:20pm

Hi Friends!

WPA Enterprise support is here! We have a pre-release firmware version 0.7.0-rc.x that is waiting for you to start using now. Also remember that it is not ready for production until it’s defaulted to 0.7.0.

Purpose

This thread will serve the purpose of creating a place to provide instructions for the WPA Enterprise setup process as it evolves, and help to answer any questions that come up about the process. Currently as of this writing we have two ways to run setup: 1) Serial setup over USB without the CLI, and 2) CLI support with v1.23.1 via particle serial wifi.

Required

WPA Enterprise requires a capable access point and a separate authentication server. We would love to see you try the various test methods below, and of course chime in and let us know if it’s working well in your already established WPA Enterprise environment (campuses, workplace, etc…).

Test Methods

Setting up a WPA2 Enterprise Test Environment with Raspberry Pi Instructions Below
Setting up a WPA2 Enterprise Test Environment with a local computer via Docker image Instructions Below
Share your own test method! Please let us know which authentication types you used and what issues you might have run into.

Setting up a WPA2 Enterprise Test Environment with Raspberry Pi

Required Gear

Raspberry Pi 2/3 for the RADIUS server
Ethernet cable
Wireless Access Point (WAP) that is capable of using WPA2 Enterprise mode, and pointing to a RADIUS server for authentication

Setup

Download RASPBIAN JESSIE WITH PIXEL
Unzip and Write to SD card using the appropriate software (ApplePi-Baker app on Mac)
Boot up the Pi with the newly created SD card
WAP should be in WPA2 Personal mode for initial configuration

The following commands need an HDMI, Keyboard and Mouse connection on the RasPi

Connect to WAP over Wi-Fi (optional)
Change resolution to 1280x720 (optional)
Rename host to radiusserver so it's easy to recognize on your Access Point (optional)
Change Keyboard to US alternative (optional)
Enable ssh (required)

Plug the RasPi into the WAP with an ethernet cable (required)

This will remove the catch 22 necessity for the RasPi to have to authenticate with itself once we enable WPA2 Enterprise

Plug your host computer into the WAP with an ethernet cable as well, so you don't lose connection with it during configuration (required)

Log into the WAP (192.168.1.1 or 10.0.0.1 typically)
Find the list of clients, and grab the IP address for device "radiusserver"

ssh pi@<ip_address>
Add a password for root

sudo passwd root
Change PermitRootLogin without-password to PermitRootLogin yes in:

sudo nano /etc/ssh/sshd_config
Reboot the Pi and login as root, commands will be much easier.

ssh root@<ip_address>
If you have previously ssh'd into this address and get an error, you may need to:

ssh-keygen -R <ip_address>
Install freeradius

apt-get install freeradius -y
Edit the clients.conf file

nano /etc/freeradius/clients.conf

add to bottom and save with CTRL + X then ENTER
```
client 0.0.0.0/0 {
        secret = "particle"
        nastype = other 
}
```
Make a directory for new certificate files on the RasPi

mkdir /etc/freeradius/certs2

Edit the eap.conf file

nano /etc/freeradius/eap.conf

Page down twice with CTLR + V

add certdir2, and cadir2 as shown

certdir = ${confdir}/certs
certdir2 = ${confdir}/certs2
cadir = ${confdir}/ certs
cadir2 = ${confdir}/certs2

modify these variables as shown

private_key_file = ${certdir2}/server.key

certificate_file = ${certdir2}/server.crt

CA_file = ${cadir2}/ca.crt

Copy certificate files
1. Download the files from this Github Repo to your local machine https://github.com/avtolstoy/particle-wpa-enterprise-docker
2. In terminal, navigate to this directory: cd particle-wpa-enterprise-docker/files/etc/freeradius/certs/
3. Finally copy the files: scp -rv * root@<ip_address>:/etc/freeradius/certs2
Edit the users file

nano /etc/freeradius/users

add to bottom and save with CTRL+X then ENTER

particle Cleartext-Password := "particle2017"
Restart freeradius in debugging mode so we can see what's going on

service freeradius stop

/usr/sbin/freeradius -X

Now let's switch the WAP to use WPA Enterprise

Switch the Wireless Authentication Type to WPA2 Enterprise (apply)
Under RADIUS Setting configuration:
- Server IP Address: Enter the IP address of the radiusserver (our RasPi)
- Server Port: 1812
- Connection Secret: particle

Setup the Photon/P1

Connect via USB cable
Enter Listening Mode
Connect via serial (screen /dev/cu.usbmodemXXXX on Mac or use Tera Term VT on Windows)

Press w

Example PEAP/MSCHAPv2 LOGIN / PASSWORD based setup (NOT SECURE!)

Note: This is the easiest setup method to gain a connection, however be warned it is not secure. Use certificates to ensure maximum security.

EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 0 <ENTER>
Username: particle <ENTER>
Password: particle2017 <ENTER>
Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <ENTER>

Example PEAP/MSCHAPv2 LOGIN / PASSWORD with Root CA based setup (SECURE!)

SSID: <WAP_SSID> <ENTER>
EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 0 <ENTER>
Username: particle <ENTER>
Password: particle2017 <ENTER>
Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <copy/paste in file ca.crt> <ENTER>
-----BEGIN CERTIFICATE-----
MIIFlDCCA3ygAwIBAgIJAI01a4ML65mlMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
...
-----END CERTIFICATE-----

Example EAP-TLS with Client Cert., Client Key and Root CA based setup (SECURE!!!)

SSID: <WAP_SSID> <ENTER>
EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 1 <ENTER>
Client certificate in PEM format: <copy/paste in file client1.crt>
-----BEGIN CERTIFICATE-----
MIIE3DCCAsSgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCVVMx
...
-----END CERTIFICATE-----

Private key in PEM format: <copy/paste in file client1.key>
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAy42H10w6nntp+Ti7Ts/czel8Gw4mz8Mh3N0R/sapRNLyznom
...
-----END RSA PRIVATE KEY-----

Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <copy/paste in file ca.crt>
-----BEGIN CERTIFICATE-----
MIIFlDCCA3ygAwIBAgIJAI01a4ML65mlMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
...
-----END CERTIFICATE-----

OUTPUT in all cases

Thanks! Wait while I save those credentials...

Awesome. Now we'll connect!

If you see a pulsing cyan light, your device
has connected to the Cloud and is ready to go!

If your LED flashes red or you encounter any other problems,
visit https://www.particle.io/support to debug.

Particle <3 you!

If you are still SSH'd into your RasPi, you should see activity from the freeradius process, and your device should have an internet connection.
If you don't see any activity, try rebooting your RasPi

BDub · June 29, 2017, 4:20pm

Setting up a WPA2 Enterprise Test Environment with a local computer via Docker image

Required Gear

Local Computer for the RADIUS server
Docker pre-installed
Ethernet cable
Wireless Access Point (WAP) that is capable of using WPA2 Enterprise mode, and pointing to a RADIUS server for authentication

Setup

WAP should be in WPA2 Personal mode for initial configuration
Plug the Local Machine into the WAP with an ethernet cable (required)

This will remove the catch 22 necessity for the Local Computer needing to authenticate with itself once we enable WPA2 Enterprise
Log into the WAP (192.168.1.1 or 10.0.0.1 typically)
Find the list of clients, and grab the IP address for your Local Computer
Clone this repo on your Local Machine GitHub - avtolstoy/particle-wpa-enterprise-docker: A Docker image with a test FreeRADIUS configuration to test EAP-TLS and PEAP/MSCHAPv2 authentication.

git clone git@github.com:avtolstoy/particle-wpa-enterprise-docker.git
Navigate to the particle-wpa-enterprise-docker directory on your Local Computer via terminal.
Build the Docker Image (this will take a while)

docker build --no-cache=true -t particle-wpa-enterprise .
Run the Docker Image (you should see debugging output from the FreeRADIUS process)

docker run -p 0.0.0.0:1812:1812/udp particle-wpa-enterprise

Now let's switch the WAP to use WPA Enterprise

Switch the Wireless Authentication Type to WPA2 Enterprise (apply)
Under RADIUS Setting configuration:
- Server IP Address: Enter the IP address of the Local Machine
- Server Port: 1812
- Connection Secret: particle

Setup the Photon/P1

Connect via USB cable
Enter Listening Mode
Connect via serial (screen /dev/cu.usbmodemXXXX on Mac or use Tera Term VT on Windows)

Press w

Example PEAP/MSCHAPv2 LOGIN / PASSWORD based setup (NOT SECURE!)

Note: This is the easiest setup method to gain a connection, however be warned it is not secure. Use certificates to ensure maximum security.

EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 0 <ENTER>
Username: particle <ENTER>
Password: particle2017 <ENTER>
Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <ENTER>

Example PEAP/MSCHAPv2 LOGIN / PASSWORD with Root CA based setup (SECURE!)

SSID: <WAP_SSID> <ENTER>
EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 0 <ENTER>
Username: particle <ENTER>
Password: particle2017 <ENTER>
Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <copy/paste in file ca.crt> <ENTER>
-----BEGIN CERTIFICATE-----
MIIFlDCCA3ygAwIBAgIJAI01a4ML65mlMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
...
-----END CERTIFICATE-----

Example EAP-TLS with Client Cert., Client Key and Root CA based setup (SECURE!!!)

SSID: <WAP_SSID> <ENTER>
EAP Type 0=PEAP/MSCHAPv2, 1=EAP-TLS: 1 <ENTER>
Client certificate in PEM format: <copy/paste in file client1.crt>
-----BEGIN CERTIFICATE-----
MIIE3DCCAsSgAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwVzELMAkGA1UEBhMCVVMx
...
-----END CERTIFICATE-----

Private key in PEM format: <copy/paste in file client1.key>
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAy42H10w6nntp+Ti7Ts/czel8Gw4mz8Mh3N0R/sapRNLyznom
...
-----END RSA PRIVATE KEY-----

Outer identity (optional): <ENTER>
Root CA in PEM format (optional): <copy/paste in file ca.crt>
-----BEGIN CERTIFICATE-----
MIIFlDCCA3ygAwIBAgIJAI01a4ML65mlMA0GCSqGSIb3DQEBCwUAMFcxCzAJBgNV
...
-----END CERTIFICATE-----

OUTPUT in all cases

Thanks! Wait while I save those credentials...

Awesome. Now we'll connect!

If you see a pulsing cyan light, your device
has connected to the Cloud and is ready to go!

If your LED flashes red or you encounter any other problems,
visit https://www.particle.io/support to debug.

Particle <3 you!

If you still have the Docker process in Terminal open, you should see activity from the freeradius process, and your device should have an internet connection.
If you don't see any activity, try restarting the Docker image (see kill command below, run is above).
If you'd like to terminate the Docker image, follow these steps:

Run:

docker ps

Find the Container ID for the particle-wpa-enterprise Image.

docker kill <id>

BDub · June 29, 2017, 6:55pm

Saving a spot for CLI setup

Viscacha · July 7, 2017, 10:27am

This all looks very promising, will anybody be altering the SoftAP example to support this?
I would imagine it would need the user to have the key and certificate stored as files on their device and then a way of uploading them, tapping them in on a phone would be a disaster!

BDub · July 7, 2017, 3:47pm

Thanks @Viscacha Do you mean the SoftAP HTTP Pages in firmware, or Photon Web Setup? There is released support for WPA Enterprise in the softap-setup-js library now, so this is on our radar along with support in the iOS and Android Tinker apps!

Viscacha · July 7, 2017, 4:03pm

I mean the SoftAP HTTP pages

naikrovek · July 11, 2017, 5:55pm

Oh holy cow I am happy about this. I haven’t tested it yet, and I have the infrastructure to test ALL of the scenarios you’ve (very helpfully) outlined.

not much of a requirement for me, but I suspect the next ask you’re going to receive in terms of enterprise compatibility is going to be proxy support. not everyone uses transparent proxies.

BDub · July 20, 2017, 2:56pm

@Viscacha actually I misinterpreted something and SoftAP HTTP Pages doesn’t require any firmware changes, just the example needs to be updated. Pull requests to the Docs repo for this example would be very welcome

Viscacha · July 20, 2017, 3:06pm

I figured I could probably call the relevant functions if I added them to the page but my HTML skills date back to the use of tags like <FRAME>`` and `` <BLINK>

naikrovek · July 27, 2017, 4:28pm

I’m having an issue on a Photon that I’ve upgraded to 0.7.0 with an ST-Link. I always get an error when it tries to save the credentials I have entered. No one else is reporting this (that I’ve found) so I’m pretty sure it’s something I’ve done wrong. I don’t know what it could be, though.

Anyone know?

ScruffR · July 27, 2017, 4:52pm

How are you applying the credentials?

Since SoftAP is mentioned in this thread, there is an open issue about 0.7.0-xxx and SoftAP here

naikrovek · July 27, 2017, 5:19pm

I’m using the serial interface, so I don’t think that bug applies to me.

ScruffR · July 27, 2017, 7:22pm

What error would this be?
Is the network present and visible?
Are you using CLI or a serial terminal via the w command?

naikrovek · July 27, 2017, 7:48pm

I can’t recall the error at the moment, and it is related to not being able to save the configuration. I can’t find one now to test with, and the one I’m having an issue with is at work. I’ll get you the exact error message tomorrow.

Network is present and visible.

Serial terminal via w command.

naikrovek · July 28, 2017, 6:48pm

Here’s the error I see. I’m not prompted for credentials, which I imagine is the second stage of this procedure.

ScruffR · July 28, 2017, 8:32pm

That’s something for @rickkas7 to look into (and maybe forward to the engineers)

Visionary · August 2, 2017, 3:20pm

Hello there!

I'm trying to connect my Photon to the WiFi of my university using WPA2-Enterprise/PEAP/MSCHAP2.
My code seems fine, I'm using the 0.7.0-rc2 firmware, but I get the following log:

0000005603 [hal.wlan] INFO: Clearing enterprise credentials
0000005684 [hal.wlan] INFO: EAP config valid: 0
0000005684 [hal.wlan] INFO: Writing EAP configuration

0000005850 [hal.wlan] INFO: EAP config valid: 1
0000005850 [hal.wlan] INFO: Writing EAP configuration
0000007269 [hal.wlan] ERROR: wiced_join_ap_specific(), result: 1025
0000007703 [hal.wlan] INFO: Joining CampusWLAN
0000008489 [hal.wlan] ERROR: wiced_join_ap_specific(), result: 1025
0000008924 [hal.wlan] INFO: Joining CampusWLAN

Sometimes i get a 1025 result, sometimes 1024 and sometimes 1006. But I don't even know if these numbers are relevant.

My code doesn't do anything special:

WiFiCredentials credentials("CampusWLAN", WPA2_ENTERPRISE);
// EAP type: PEAP/MSCHAPv2
credentials.setEapType(WLAN_EAP_TYPE_PEAP);
credentials.setIdentity("user");
credentials.setPassword("pass");
credentials.setCipher(WLAN_CIPHER_AES);
credentials.setOuterIdentity("anonymous");

WiFi.setCredentials(credentials);

Checking the settings i made in Ubuntu, it should work. Can I get a better a better log with more info or more details about this somehow?

Thanks for your help!

BDub · August 2, 2017, 3:37pm

@naikrovek This one may indicate that you are out of heap needed for WPA Enterprise. Try reducing some of the static ram allocation in your user app, possibly moving things to flash with const. You can also use the System.freeMemory() to get an idea of where you are at.[quote="Visionary, post:20, topic:34167"]

Sometimes i get a 1025 result, sometimes 1024 and sometimes 1006. But I don't even know if these numbers are relevant.
[/quote]

@Visionary would you please try a few things for me? I'd like to know if you get the same issue if you use the serial based setup (see above). Also if you move to different locations on campus do you still have problems? What is the signal strength of the network as reported by your computer? Try commenting out credentials.setOuterIdentity("anonymous"); as well and leave this as the default setting. When trying serial based setup, just press enter for Outer Identity vs. typing "anonymous" first.

Topic		Replies	Views
Argon, particle-cli & WPA2 Enterprise (PEAP/MSCHAPv2) Troubleshooting	31	2643	October 5, 2021
Will there be Native App support for WPA2 Enterprise? Developer Tools photon	2	585	February 6, 2019
[PHOTON] Enterprise network Firmware	11	4723	July 6, 2017
Establishing a test environment for WPA2 Enterprise Troubleshooting photon	4	1413	September 16, 2019
WPA Enterprise Support - Beating a Possible Dead Horse General	10	2952	July 6, 2017

Setting up Photon/P1 on WPA Enterprise (0.7.0)

Purpose

Required

Test Methods

More WPA Enterprise Docs links:

Setting up a WPA2 Enterprise Test Environment with Raspberry Pi

Required Gear

Setup

The following commands need an HDMI, Keyboard and Mouse connection on the RasPi

Plug the RasPi into the WAP with an ethernet cable (required)

Plug your host computer into the WAP with an ethernet cable as well, so you don't lose connection with it during configuration (required)

Now let's switch the WAP to use WPA Enterprise

Setup the Photon/P1

Setting up a WPA2 Enterprise Test Environment with a local computer via Docker image

Required Gear

Setup

Now let's switch the WAP to use WPA Enterprise

Setup the Photon/P1

Saving a spot for CLI setup

Related topics