-
Notifications
You must be signed in to change notification settings - Fork 13.3k
WPA2 enterprise with credentials auth ok with radius but still get STATION_WRONG_PASSWORD after 30s #6803
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Comments
We have no control on this API.
If it still does not work, what you would have to do is to make a native nonos-sdk test (branch 2.2.x - the one we use) and check if this issue is still there. And if it is, try with their branch 3.x. And if it is still there, then open an issue on their repository. |
WPA2 isn't fully supported by the sdk (we're still waiting for a working example of the limited use case), and we don't have core code on our side to wrap it. The one thing to try is what @d-a-v says above, which disables an optimization that returns the stacks to their normal places. That allows more stack space for SYS, just in case the optimized reduced stack being blown up is what you're running into. |
Just for me to understand what I should be doing regarding the nonos-sdk versions. Thanks NB : seems like the option "disable_extra4k_at_link_time()" you gave me is not found in my environment, any advice ?
|
I had to include this code in order for the Arduino IDE to find the function "disable_extra4k_at_link_time()" ... But unfortunately, no change to be reported on the wifi association/authentication behavior. |
This is not lwip1, lwip1 is selectable in arduino IDE menus or environment variables in PIO
nonos-sdk example: https://github.com/espressif/ESP8266_NONOS_SDK/tree/master/examples/wpa2_enterprise maybe it can help (maybe not): https://github.com/d-a-v/esp8266-nonos-easy-sdk (unmaintained) |
I tried to enable "debug level" on "Wifi" to check for any further/complementary messages, and I got these :
Seems like EAP-MSCHAPV2 is taking place correctly, but then, nothing happens. I have some doubts about the fact that "wifi_station_get_connect_status" updates correctly its status value once associated. Or maybe I'm wrong and the following sequency just means that there is some problem with the authentication on RADIUS side (which on RADIUS event log doesn't seem to be ...) :
NB : I tried to change lwIP to something else, for now I just tried :
Makes me think about this post : |
I personally never observed WPA2 working.
|
There is some interesting information on this link Seems like it is stated that :
Something is strange by the way because it seems that I can't change the authentication protocol used from EAP-MSCHAPV2 to something else. Actually my wifi clients authenticates fine with "Microsoft : Protected EAP (PEAP)". |
Seems like the only to get past this problem is to upgrade to NONOS SDK v3 / v3.0.0 Thanks for your hard work guys ! |
Basic Infos
Platform
Settings in IDE
Problem Description
Wifi router is a Synology RT1900ac with WPA2 Enterprise authentication enabled.
RADIUS server is a NPS running on Windows Server 2019.
Policies are configured with :
- Conditions > NAS Port Type > Wireless - Other OR Wireless - IEEE 802.11
- Conditions > NAS Identifier >
- Conditions > Calling Station ID > <MAC ADDRESS FROM NodeMCU/ESP8266>
- Conditions > Windows Groups >
- Constraints > Authentication Methods > Microsoft Secure Password (EAP-MSCHAP v2)
Behavior of code (chronologically) :
- [ESP8266] boots up then tries to associate/authenticate
- [RADIUS/NPS] receives AUTH and grant access
- [ESP8266] On the first 30 seconds, "wifi_station_get_connect_status" == 1 ()
- [ESP8266] Then after 2nd AUTH which takes place at 30s after 1st one : "wifi_station_get_connect_status" switch to == 2 (STATION_WRONG_PASSWORD)
- [RADIUS/NPS] Everytime ESP8266 tries to AUTH it gets access granted anyway
- [ESP8266] Never gets DHCP lease / IP address (even trying to assign it manually // code is available inside the given example)
Seems like a lot of people have problems trying to use WPA2 Enterprise with credentials.
NB : I did not tried to use certificates at all as I do not want to.
Thanks for ideas/suggestions/anything of value will be greatly appreciated.
Sample message from NPS server on Windows Server 2019 (acting as RADIUS server here)
Network Policy Server granted access to a user.
MCVE Sketch
The text was updated successfully, but these errors were encountered: