Issues with 802.1x and Authentication

Question

Level 1

20 points

Issues with 802.1x and Authentication

Has anyone else had success at connecting to Cisco 802.1x wireless networks with the iPhone 2.0 firmware? I work in a predominantly Windows-based environment in a building covered with 802.1x access points that use MS active directory for authentication. I’ve been having great luck with my Macbook Pro being able to log on to the network and interoperate just fine using the 802.1x settings. I was hoping that the 2.0 firmware would let me get on the network with my iPhone, but it’s been extremely frustrating so far.

Originally, I configured the network manually on my iPhone as a WPA (enterprise) network, as suggested in the Apple Enterprise Deployment Guide since there isn't a specific 802.1x setting, and used my usual domain username and password. It connected right away, gave me the usual “certificate not verified” info box just like my Mac does every time I connect to network (on the Mac I just hit “accept” and everything works great), I hit “accept” to override the certificate thing, got a full strength WiFi signal, and was on the network perfectly. I was thrilled and thought I had success. Unfortunately, a few minutes later, when I wasn’t using my phone, it went to sleep like usual, but when I woke the phone back up, it couldn’t reconnect to the network. It could see the network and got the 169.x.x.x self-assigned address, but apparently can’t get past the authentication.

If I delete all the wireless settings and try again, it gives me the same “certificate not verified” thing, I hit accept, but then it just gets stuck at “joining wireless network” but never connects. Here’s the error log from the phone (as captured using the enterprise iPhone Configuration Utility):

Fri Jul 11 12:14:13 unknown configd[21] <Notice>: WiFi: Disabling auto join from pid 344
Fri Jul 11 12:14:14 unknown kernel[0] <Debug>: AppleMRVL868x::setASSOCIATE() [Preferences]: lowerAuth = AUTHTYPE_OPEN, upperAuth = AUTHTYPE WEP8021X, key = CIPHER_NONE, flags = 0x8
Fri Jul 11 12:14:14 unknown eapolclient[348] <Notice>: en0 START
Fri Jul 11 12:14:14 unknown kernel[0] <Debug>: AppleMRVL868x Joined AP: BSSID = 00:16:46:b8:75:50, rssi = 33, rate = 54 (100%), channel = 1, encryption = 0x2, ap = 1, hidden = 1, directed = 1, failures = 0, age = 2, ssid = "mycompanyssid"
Fri Jul 11 12:14:14 unknown kernel[0] <Debug>: AirPort: Link Up on en0
Fri Jul 11 12:14:14 unknown eapolclient[348] <Notice>: peap verifyserver: server certificate not trusted, status 6 0
Fri Jul 11 12:14:15 unknown mDNSResponder[17] <Error>: Note: DNS Server 172.18.145.103 for domain . registered more than once
Fri Jul 11 12:14:20 unknown mDNSResponder[17] <Error>: Note: DNS Server 172.18.145.103 for domain . registered more than once
Fri Jul 11 12:14:54 unknown kernel[0] <Debug>: [9909.210936332]: void AppleMRVL868x::handleEventPacket(const UInt8*): Deauthenticated by 00:16:46:b8:75:50, IEEE Reason 2
Fri Jul 11 12:14:54 unknown kernel[0] <Debug>: AppleMRVL868x Deauth'ed AP: BSSID = 00:16:46:b8:75:50, rssi = 33, rate = 54 (100%), channel = 1, encryption = 0x2, ap = 1, hidden = 1, directed = 1, failures = 0, age = 42, ssid = "mycompanyssid"
Fri Jul 11 12:14:55 unknown mDNSResponder[17] <Error>: Note: DNS Server 172.18.145.103 for domain . registered more than once
Fri Jul 11 12:14:59 unknown mDNSResponder[17] <Error>: Note: DNS Server 172.18.145.103 for domain . registered more than once

I've tried deleting settings, rebooting the phone, and a ton of other stuff but all to no avail. I even tried the new iPhone Configuration Utility intended for enterprise stuff, created a configuration profile with my login info, and even that didn't help. Aaargh! Unfortunately, our IT department is rather Mac-hostile so getting debugging help from them isn't terribly likely. Anyone have any ideas?

MacBook Pro, Mac OS X (10.5), CoreDuo

Posted on Jul 11, 2008 5:49 PM

Reply

Answer 1

theeven

Level 1

0 points

Jul 11, 2008 7:20 PM in response to dg1132

I am having exactly the same problem. trying hard to make it work. No luck yet. Help Needed.

Reply

Answer 2

Jul 12, 2008 9:19 AM in response to dg1132

I'm having the exact same problem. I'm trying to connect to my school's network and if (a big IF) I get the network connected, it'll show bars next to the name but not in the info bar at the top of the phone. Also, the only time I've actually gotten a connection was using the iPhone Config Utility. I put in my information that I use to get on the network (TTLS, etc.). Hopefully I'll find a way to get on the network. (Unless it's a software problem with 2.0.)

Message was edited by: Tconstruct

Reply

Answer 3

mehfisto

Level 1

15 points

Jul 12, 2008 1:17 PM in response to dg1132

Are you sure you have the correct certificate?

Here's how I got it working (Cisco Aironet with MS AD Auth):

On a windows machine that you are logged into with the credentials you want to auth to wireless with:

1. Run certmgr.msc
2. Find Personal Certificates
3. Export your personal cert, with private key.
4. Set a short password.
5. Mail this certificate to your iPhone.
6. Open the attached cert in your iPhone.
7. Accept it, provide the password.
8. Try to connect to wi-fi, provide your credentials.

Hope this helps.

Reply

Answer 4

Jul 13, 2008 7:56 PM in response to dg1132

Hello,

I suspect your problem is the fact that you're using self-signed certificates, but you haven't installed and trusted the root cert that issued them. The reason the phone can't validate the certificate is because it doesn't trust the issuer (or you don't have all of the certificates in the chain if you have intermediate CAs). That's also the problem with your Mac client forcing you to hit 'Accept' each time you authenticate - it doesn't trust the root CA. You should be able to talk to your IT folks to get a copy of it to import and trust (the certificate itself isn't secret).

1. Once you have the certificate, import it into your Mac's keychain and set the appropriate trust settings.

2. You should use the iPhone Configuration utility to create a profile to install the certificates onto the phone. On the Credentials tab hit '+' and browse to the location of the root certificate you got from IT. Once it's part of the profile you can then setup the Wi-Fi settings as needed.

This can get tricky, depending on the configuration your IT staff has in place. They should be amenable to providing you the same information they'd provide a Windows client (hopefully). Do you know what kind of EAP type you're using on your network? From the log the client is negotiating PEAP, which I assume is correct.

You'll need to get the certs ironed out before this will work reliably.

Reply

Answer 5

Jul 14, 2008 5:58 AM in response to dg1132

OK. Monday morning. It worked without a hitch.

When I chose the network here at the university, it asked for the username and password (which I had arranged ahead of time), then showed me the certificate and gave me a chance to verify that it is valid. After that, I am on wi-fi.

I "forgot" it and re-did it, just to make sure that would work. It did.

P.S. I didn't have to know any acronyms like EAP or PEAP to do this.

Message was edited by: Gerald Edgar

Reply