help with 802.1x enterprise wifi connection

[teacher74]

Hey Calgunners, help a fellow calgunner out. My school district finally has allowed teachers to access staff wifi with personal devices. I've been running my classroom for 2 years off my laptop with no internet connection in my classroom. So it finally was happening, but my computer is one of the 1% that won't connect. The district wifi is running the 802.1x enterprise authentication and it simply doesn't work. It won't authenticate. The district tech guys are prohibited from helping us since it's on a personal device. So, I'm stuck.

I have a lenovo ideapad z570 with an i7 processor and running windows 7 home premium with service pack 1 installed. Any ideas what could be preventing me from connecting? I've upgraded by processor driver and my network card driver, but still nothing.

Help!

[yellowsulphur]

I've never had to connect to a RADIUS server before, but I found this and think it might help you out.

https://documentation.meraki.com/MR/Encryption_and_Authentication/Enabling_WPA2-Enterprise_in_Windows_Vista_and_Windows_7

[Cartridge]

I'm not familiar with Windows 7. Are you presented with a username and password window? What error does it show when doesn't auth?

[gibbet]

If you havent enabled wired autoconfig, do it. Google "windows 7 wired autoconfig" and you should see how to enable it for your wireless adaptor.

[the86d]

Have you done the OPTIONAL driver updates, specifically the WLAN drivers?

I am not familiar with the issue you mentioned, but I AM familiar with the issue of optional Lenovo WLAN drivers requiring an update to connect to WiFi w/out issues... (Hell, many fools don't even try a reboot when a notebook has connectivity issues and they haven't even warm-booted in months.)

[ocabj]

As someone who has managed RADIUS for the past 10+ years specifically for WiFi auth at a university, I'm going to hazard a guess that it's most likely a supplicant problem.

Windows will natively support EAP-MSCHAPv2. Do you know what EAP protocols are officially supported by your school's WiFi? MSCHAPv2 does require the RADIUS backend to support NTPassword hashes, so if the backend user store is not Windows AD/LDAP and is actually something else (e.g. OpenLDAP), it's possible they don't have NTPassword hashes in your ldap entry and are using something else (e.g. SHA256 hashes).

I would say follow whatever is on the district's published documentation on how to connect to the WiFi. If they have a suggested third-party supplicant (e.g. SecureW2), go with that and follow their settings.

At my campus, we support most of the EAP protocols:

IEEE8021X/TTLS/PAP Access-Accept
IEEE8021X/TTLS/MSCHAPV2 Access-Accept
IEEE8021X/PEAP/PAP Access-Accept
IEEE8021X/PEAP/CHAP Access-Accept
IEEE8021X/PEAP/MSCHAPV2 Access-Accept

On our WPA2 Enterprise network, most Mac OS X / iOS endpoints use EAP-PEAP-GTC and Windows folks will just use EAP-MSCHAPv2. But EAP-TTLS works just fine for either Windows (using 3rd party supplicant) or Mac/iOS.

Note: There is also a bug that is making the rounds with RADIUS admins (whether an appliance or RADIUS software e.g. FreeRADIUS) where endpoints that are defaulting to using TLS 1.2 are failing to authenticate. I believe it has something to do with how MPPE keys are calculated via TLS 1.2. I highly doubt this is the problem in your case, but there is the remote possibility. But then this would affect a larger subset of people in your district, and your admins would need to update their RADIUS server.

[teacher74]

I've never had to connect to a RADIUS server before, but I found this and think it might help you out.

https://documentation.meraki.com/MR/..._and_Windows_7

Thanks - I'll try this one at work today

[teacher74]

I'm not familiar with Windows 7. Are you presented with a username and password window? What error does it show when doesn't auth?

I'm presented with a prompt to input username and password - district supplied. Then just a generic error that windows cannot connect. No codes or anything.

[teacher74]

Have you done the OPTIONAL driver updates, specifically the WLAN drivers?

I am not familiar with the issue you mentioned, but I AM familiar with the issue of optional Lenovo WLAN drivers requiring an update to connect to WiFi w/out issues... (Hell, many fools don't even try a reboot when a notebook has connectivity issues and they haven't even warm-booted in months.)

Everything in windows update is updated, except for the update to windows 10. Yes, I have rebooted.

[teacher74]

As someone who has managed RADIUS for the past 10+ years specifically for WiFi auth at a university, I'm going to hazard a guess that it's most likely a supplicant problem.

Windows will natively support EAP-MSCHAPv2. Do you know what EAP protocols are officially supported by your school's WiFi? MSCHAPv2 does require the RADIUS backend to support NTPassword hashes, so if the backend user store is not Windows AD/LDAP and is actually something else (e.g. OpenLDAP), it's possible they don't have NTPassword hashes in your ldap entry and are using something else (e.g. SHA256 hashes).

I would say follow whatever is on the district's published documentation on how to connect to the WiFi. If they have a suggested third-party supplicant (e.g. SecureW2), go with that and follow their settings.

At my campus, we support most of the EAP protocols:

IEEE8021X/TTLS/PAP Access-Accept
IEEE8021X/TTLS/MSCHAPV2 Access-Accept
IEEE8021X/PEAP/PAP Access-Accept
IEEE8021X/PEAP/CHAP Access-Accept
IEEE8021X/PEAP/MSCHAPV2 Access-Accept

On our WPA2 Enterprise network, most Mac OS X / iOS endpoints use EAP-PEAP-GTC and Windows folks will just use EAP-MSCHAPv2. But EAP-TTLS works just fine for either Windows (using 3rd party supplicant) or Mac/iOS.

Note: There is also a bug that is making the rounds with RADIUS admins (whether an appliance or RADIUS software e.g. FreeRADIUS) where endpoints that are defaulting to using TLS 1.2 are failing to authenticate. I believe it has something to do with how MPPE keys are calculated via TLS 1.2. I highly doubt this is the problem in your case, but there is the remote possibility. But then this would affect a larger subset of people in your district, and your admins would need to update their RADIUS server.

While most of this is over my head, a big part of the problem is that there is no supporting documentation or any info from the district. All that has been published is that you can now access the staff wifi using your username and password. If it doesn't work, it's your own problem and tech support will not help you get connected. No help with what the district configuration looks like or what settings could help you. Nothing! - very frustrating.

[teacher74]

If you havent enabled wired autoconfig, do it. Google "windows 7 wired autoconfig" and you should see how to enable it for your wireless adaptor.

Thanks - Will try this one today as well!

[ocabj]

While most of this is over my head, a big part of the problem is that there is no supporting documentation or any info from the district. All that has been published is that you can now access the staff wifi using your username and password. If it doesn't work, it's your own problem and tech support will not help you get connected. No help with what the district configuration looks like or what settings could help you. Nothing! - very frustrating.

How did you connect your work device(s) to the school WiFi?

[teacher74]

I've never had to connect to a RADIUS server before, but I found this and think it might help you out.

https://documentation.meraki.com/MR/..._and_Windows_7

Thanks a million! This setup seems to work! I was finally able to connect to the district wifi. However, my school district uses office 365 for email. For some reason, I cannot connect to office 365, but everything else seems to be working.

Any ideas why some sites would work and others not?

[teacher74]

How did you connect your work device(s) to the school WiFi?

Our IT dept has a strong control over it all. They connect all work devices. It's been a difficult process for them to give over access to staff wifi for non district devices.

[SwissFluCase]

Windows by default does not allow untrusted certificates presented by a RADIUS server to be used for wireless connections. The two solutions are the either disable the security (which you did), or install a copy of the certificate locally on your machine as a trusted certificate. Windows machines as part of an Active Directory domain often take care of installing the certificate automatically, and the connection is seamless.

The intent is to prevent rouge AP attacks.

IOS doesn't care and will allow you to connect. You can still validate the certificate manually.

As far as O365, I'm not sure what the district may be doing. You may need to register your machine with O365 (workplace join). That's speculation, though. What is the exact error that you get when you try to go to O365?

Regards,


SwissFluCase