Re: WPA2/Enterprise startup/rollout headaches...

[Justin Azoff <JAzoff () UAMAIL ALBANY EDU>]

On Wed, Jul 13, 2011 at 09:50:51AM -0400, Jeff Kell wrote:
> One of our summer projects is to bring WPA2/Enterprise to our wireless network, which is currently either plaintext 
> or using pre-shared keys, simply terminating on the controller.
..
> However, we cannot seem to get any clients to successfully
> authenticate to wireless.  Win7 seems to get the farthest
> (out-of-the-box, no supplicants or certificates), prompting once for
> credentials when it tries PEAP, and failing that (perhaps due to the
> unknown certificate?), it prompts again in a pop-up window for
> "EAP-TTLS credentials" asking for domain\userID and password.  We then
> see Radiator trying the request/challenge several times before
> eventually rejecting, and there is no connection.

The main thing to determine is if you are seeing challenge RESPONSES or
not.  If you are having certificate related problems, you'll see
challenge requests go out to the client, but the client will ignore them
and never respond.  If you're getting challenge responses from the
client, but the authentication itself is failing, your problem lies
elsewhere.

Windows has a way to get logging out of the supplicant:

http://technet.microsoft.com/en-us/library/bb457018.aspx

the Eapol.log should definitively show why things aren't working.

> Is there another whole piece of the puzzle we are missing to carry
> over to the clients?  I know at times in the past that various
> supplicants, shims, or some "connectivity add-ons" (e.g.,
> XpressConnect) were required to complete the picture, but I thought
> most of this could be done "out of the box" by now?

You shouldn't need anything.. Windows had been a pain in the past, but 7
fixed that I think.

-- 
-- Justin Azoff
-- Network Security & Performance Analyst