Skip to main content
ganesh_karale
ganesh_karale
Explorer III
December 16, 2024
Question

802 1x Certificate based authentication where FNAC is acting as radius

  • December 16, 2024
  • 1 reply
  • 2276 views

Hi, We are using Aruba as wireless controller and FortiNAC is acting as Local Radius Server, EAP type is TLS and TTLS.

We wanted to enable certificate base authentication for the users who will try to connect wifi.

For Wired users its working perfectly fine but for Wireless Users we seen that the without certificate users are able to connect.. In Radius Logs we seen that the Authentication method is MSCHAPV2, that should not work as its disabled in Radius Default Config.

 

Please guide.

 

 

 

1 reply

ebilcari
Staff
ebilcari
Staff
December 16, 2024

How many entries are in the RADIUS Local servers?

In the 'Supported EAP Types', only EAP TLS and TTLS are enabled? PEAP/MSCHAPv2 will relay on the Winbind tool to check credentials, if it's not used in this setup you can also limit this authentications by disabling this service.

Emirjon
    ganesh_karale
    ganesh_karaleAuthor
    Explorer III
    December 16, 2024

    Dear Emirjon

     

    Only EAP TLS and TTLS is enabled also the the Winbind is disabled.

     

    ebilcari
    Staff
    ebilcari
    Staff
    December 16, 2024

    Than this is technically not possible, make sure the hosts are not currently authenticating with TTLS, that is practically the same as PEAP but the password are in clear text (not using the challenges). At least for testing you can also create a new local server with only TLS selected and use it in model configuration of the WLC.
    Keep in mind that even if the RADIUS server doesn't support a type of authentication, it doesn't prevent the hosts from attempting it. As long as the requests are EAP-based, the WLC will forward them to FNAC.

    Emirjon
      Terms & ConditionsAccessibility statement