iPad can't get in the internet via a WPA2 Enterprise setup

Hello Skarin!

So at this point, have you sent a Configuration Profile to your iPad using the iPhone Configuration Utility? If not, it should be as simple as downloading it to any computer, then connecting your iPad. Here are some rough steps you will need to follow once it is installed:
1) Create a new Configuration Profile
2) Fill out the General tab with your information
3) Add a WiFi payload, specifying the SSID, Security Type (WPA2 Enterprise), and then selecting PEAP as your Protocol. You may also want to fill out your Domain\Username under Authentication.
4) Install this profile on your iPad, then try to connect under the WiFi tab again.

Let me know if this works... I'm kinda curious =)

From the sounds of things, you're 2/3 of the way there - your iPad is talking PEAP to the AP, and there shouldn't be a trust issue as you are manually accepting the certificate. That only leaves an Authentication issue. Are you specifying your Outer Identity in the iPhone Configuration Tool, as well as properly specifying your DOMAIN\USERNAME credentials? In most cases, the Username and Outer Identity should be the same, but it all depends on what the RADIUS server on the far end of the AP is looking for.
It is possible that something else is happening on the network (MAC filtering, Windows Network Protection Service, etc.) to proactively block your attempts to connect, but the only way to know about these is to ask your friendly local administrator (if you have one).
And yes, this should definitely be possible... =)

"Unsupported" device - I've heard that before, too many times... =)
So after thinking on everything you've tried, it's safe to say that your AP is running PEAPv0 with EAP-MSCHAPv2 for Authentication. This is good news - as it is probably the most widely used Enterprise WiFi configuration, iOS devices should absolutely be compatible with this. Getting a non-domain XP PC connected was a great idea, as I have discovered that Windows XP is kind of "loose" in the way it handles PEAP certificates - it will accept any certificate given to it by a RADIUS server without question. Undoubtedly a big security hole, but it does have the advantage of being "user friendly." I don't think Apple's implementation is quite as loose, so even though you are manually accepting one certificate, you probably need more to complete the chain of trust required for your device to authenticate the server. This is a requirement for PEAP to function.
So at this point, I think your best bet would be to migrate over to the Credentials tab. If you're running the iPhone Config Utility on a PC which connects to the AP, you already have the certificates in your trusted certificate store - so simply hit the add button and add any relevant certificates. For example, if your domain is named "corporate", import any certificates bearing that domain. Once you've done this, head over to the Trust tab under WiFi and check off your newly imported certificates as being trusted for your connection.
In addition, if you can figure out what the name of the RADIUS server on the other end of the AP is doing the authentication, add it under "Trusted Certificate Names" - if you don't know it, you can also add a wildcard like "*.corporate" to trust any servers in your domain. This shotgun approach is probably your best bet for making it go initially.
You will know this is all working when you no longer get the dialog on your iPad to accept the certificate, and hopefully, you get an IP address.
We're truly in the thick of it now, and this is my last idea - so if this does not work, we will need to call on those stronger than I with iOS networking... or, you can call up your IT department and start the conversation off with the words "I bet you can't figure this out" - that always gets IT people going =)
Best of luck!

Sources:
http://howto.techworld.com/mobile-wireless/3451/use-peap-for-wireless-authentica tion/

http://images.apple.com/ipad/business/pdf/iPadDeploymentScenarios.pdf

i'm a network manager and run a Cisco wireless network for my users. The iPad and iPhone generally work right off the bat withouth any changes, even though you can make some adjustments if you wish - We don't enforce any of these here (they would be RADIUS settings) as the security that the ipad and iphone set up are acceptable although technically could lead to (at least in theory) a faked SSID with the same name as your being setup in an effort to capture details. Anyway, the fact that you get the cert is a good sign.

Personally (and this does depend on RADIUS setup and backend database) we prefer users to use the following username convention:

username@domain

If you see wireless symbol after this point you have passed the 802.1x login. Even with our systems 802.1x is quite tempremental on the DHCP side of things and to Cisco WCS/WLC combination (which I am guessing your company will be using) also can enforce DHCP etc, but also has the ability to block clients it thinks are a threat.

The best piece of adivce I can give you is that network engineers don't like to be told what the problem is, however if you talk to them with respect (rather than treating them like something you walked in) and ask for help this usually works. Especially if you show them your shiney toy!

BTW, for the most part with Cisco wireless systems, if you try using a static IP Address that is a sure fire way to get your device excluded (black listed) which might be timed but maybe permanent (ie needs your network admins to manually remove).

Lastly I know that of a dozen or more ipads in my local area that successfully connect to our wireless system which based upon your description sound very similar to yours.

Paul

I'm keeping an eye on this thread as well. We have a similar setup and can't get the thing to work...oh, and I'M the admin. Authentication is successful, cert is allowed, and that's it. Trying to find some kind of logs somewhere to tell me what's going on but haven't been successful as of yet.

Are you using a proxy server? If so (like our corporation. I set the proxy server one the wireless tab to MANUAL and then put in my PROXY SERVER, turn on Authentication and enter my username and password. Once the Proxy information is setup it will allow you access except for what ever is blocked by the corporation in the proxy. (usually YouTube, facebook, and for whatever reason dropbox is also blocked.) Usually, I go to Safari and see if I can access the outside world (www.google.com) if it is set up correctly it will load.

I am trying to work on a solution to get the proxy to work with exceptions but haven't quite figured it out yet. I work in our corporate IT organization but this is still uncharted territory and makes most IT people nervous.

Do you happen to know if your Cisco wireless network is using the Access Points in H-REAP mode? This was causing some significant issues with IOS 4.0-4.2 but appears to be resolved in 4.3.

Once you get the device connected, even if you don't have an IP, try restarting the iPad or iPhone. For my Cisco network that seems to get it an IP.

Skarin wrote:
Uncheck the "Validate Server Certificate"
Authentication Method is EAP-MSCHAP v2 on the PEAP properties screen

Mac OS X, and iOS by extension, do not allow you to ignore the server certificate, which is what that first line effectively does. You must use an actual certificate, which is signed by a trusted root (which can even be your own root CA, but it's got to be signed by something besides itself.)

Secondly, Mac OS X (and iOS) do not support EAP-MSCHAPv2 inner authentication for 802.1x. To get around this where I work, we enabled TTLS / MSCHAPv2 authentication on the RADIUS server in addition to the PEAP / EAP-MSCHAPv2 authentication, and all things Apple work great with the same functional security. This was on a Juniper Networks SBR RADIUS server.

Short version: get a non-self-signed certificate, and set up TTLS. Is it a PITA, sure; but it's what works.

Message was edited by: Christopher Flanagan