[WPA2-ENT] Problem connecting to WPA2 Enterprise using PEAP-MSCHAPV2

[Gijs]

@Alephus I'll work out some debug statements in the firmware on Friday that should give us more details about what is exactly happening on lower levels. Unfortunately Im not able to test the WPA2-ENT on this side so i'll have to go off of your feedback, but what I read from other users using WPA2-ENT on eduroam in C-code (https://github.com/martinius96/ESP32-eduroam)

It seems we are following very similar procudures (the actual example is listed here: https://github.com/martinius96/ESP32-eduroam/blob/master/WifiClient/examples/WifiClientEnterprise/WifiClientEnterprise.ino, im not sure if you have any experience with ESP32 in the arduino IDE, else you could perhaps try if this works, so we can figure out if it is firmware related or network related, though I might have missed something)

Gijs

[Alephus]

@Gijs im afraid my experience with ESP32 in the arduino IDE is limited but i will see what i can do, considering at the moment im sort of the tester here

Ill wait for your version and meanwhile see what i can do from my side

best regards

[Gijs]

Hi,
Sorry, it took me some more time than I estimated, I have a firmware package here
Where I made some additional changes and added debug output. Also I used this testscript: (I removed the timeout, from what I think, the WPA2_ent might need some time to get connected properly)

from network import WLAN
#other imports like machine, utime ...
import machine
network = {   #not real user and pass.... obviously....
    "SSID": "eduroam",
    "USER": "someuser@ufp.pt",
    "PASS": "somepass"
    }

print('[Wifi] Wifi starting...')
wlan = WLAN(mode=WLAN.STA)
wlan.antenna(WLAN.EXT_ANT)   #using the external antenna but even with the internal antenna this it doesnt work

print('[Wifi] Connecting to ['+network["SSID"]+'] with User ['+network["USER"]+']...')
wlan.connect(ssid=network["SSID"], auth=(WLAN.WPA2_ENT, network["USER"], network["PASS"]), identity=network["USER"])   #also tryed other timeouts

while not wlan.isconnected():
      machine.idle()   #also tryed with utime.sleep 
print('[Wifi] Wifi connected to '+network["SSID"])

Which gave this response:

[Wifi] Wifi starting...
[Wifi] Connecting to [eduroam] with User [someuser@ufp.pt]...
[modwlan] wlan_do_connect: WPA2 credentials 
         identity: someuser@ufp.pt, 
         username someuser@ufp.pt, 
         passkey: somepass
[modwlan] wlan_do_connect: setting identity
[modwlan] wlan_do_connect: setting username & password
[modwlan] wlan_do_connect: enable wpa2_ent 

Unfortunately I still cannot test the wpa2 enterprise on this side,
Let me know if this works for you!

Gijs

[Alephus]

@Gijs here is what i get (credentials changed for safety reasons):

[Wifi] Wifi starting...
[Wifi] Connecting to [eduroam]...
[modwlan] wlan_do_connect: WPA2 credentials 
         identity: convidado@ufp.pt, 
         username convidado@ufp.pt, 
         passkey: somepass
[modwlan] wlan_do_connect: setting identity
[modwlan] wlan_do_connect: setting username & password
[modwlan] wlan_do_connect: enable wpa2_ent

and then it gets stuck there after the enable wpa2_ent. Maybe something after that is getting it stuck?

[Gijs]

So after that it gets stuck trying to connect to the network and checking the credentials, Im looking into showing even more debug output from the esp-idf, so we would see the authentication process, but I have no further experience there (yet). It would be good if you were able to verify the connection does work with the Arduino script I sent before if you're able to! It seems to be quite tricky to get the settings exactly correct to reflect the specific wpa2-enterprise settings.

[jcaron]

@Alephus Probably time to get the Wi-Fi sniffer out :-)

Before that, you could try doing a Wi-Fi scan and dumping the networks to see what auth settings that network has.

You could also add add callbacks and log various events to see what the Wi-Fi stack says.

NB: in your first post the screenshot says you need to send the MAC address of the device to the local IT/Network team so they can allow it to connect. Seems overkill to me, but have you tried that?

[Gijs]

NB: in your first post the screenshot says you need to send the MAC address of the device to the local IT/Network team so they can allow it to connect. Seems overkill to me, but have you tried that?

This actually makes some sense thinking about it.
From what I know about my university (they use the same kind of WPA2-enterprise with username/password/identity) is that they only allow a limited amount of wireless connections per username in some way, to avoid dealing with hundreds of unsecure raspberry pi's on the network. Not really sure how they handle it, but it could be through mac addresses.

I would have tried the pycom device on that eduroam network, less im not allowed to go there.

[Alephus]

The wifi sniffer is actually a nice idea that i completely forgot about!
Next time im at the university i will get as much info from the sniffer as possible and continue to try to work with the arduino code. (Due to COVID, my country is currently under mandatory homestay so i kinda can only go to university when justified)

[jcaron]

@Alephus did you provide the LoPy4’s MAC address to your IT department so they can allow it to connect? It might be the key to it all...

[Alephus]

@jcaron said in [WPA2-ENT] Problem connecting to WPA2 Enterprise using PEAP-MSCHAPV2:

@Alephus did you provide the LoPy4’s MAC address to your IT department so they can allow it to connect? It might be the key to it all...

I actually questioned them about it since in the instructions it says that Teachers and non-Teachers must inform the IT departement about their MAC address, but they say that Student accounts and the 2 test accounts im using dont require it. But i will request another test account linked to the LoPy MAC address to see if thats the case.

Translation:
< Note: Teachers and non-Teachers of the
University must inform in SI&C (Information
and Comunication Sistem) the MAC address
of the equipment, to be able to connect to the
eduroam network. >

[hb asf]

Hi @Gijs,
do you have any information if the wpa2_ent issue is fixed by now. It seems that my SiPy just speakes 802.1X istead of 802.1X EAP-PEAP.
I am using this method: https://docs.pycom.io/tutorials/networks/wlan/#connecting-to-a-wpa2-enterprise-network without the square brackets and no certificate, as it's not needed.
If there already is an updated firmware or the issue is already solved i would be happy to hear.
Cheers

[yasmina djebbara]

@hb-asf same here ... apparently it's still not solved