Controllerless Networks

 View Only
  • 1.  IAP 505 802.1x Uplink

    Posted May 11, 2023 10:53 AM

    Good Morning!

    i have a problem with the configuration of 802.1x with a 505 AP as a supplicant.

    802.1x with PEAP is working fine. But not with TLS. 
    I have uploaded the CA cert and the User cert include with private key over cli with the "download-cert" command.

    Both certs are visible in Maintenance --> Certificates 


    After i change the setting in Configuration --> System --> Uplink to TLS and restart the AP no network access is possible.

    I don´t think, that is a switch problem, because PEAP is working perfect.
    I also check the Windows NPS Server with wireshark and don´t see RADIUS traffic from the switch.

    Any idea where the error could be?

    Best regards
    Patrick







  • 2.  RE: IAP 505 802.1x Uplink

    Posted May 11, 2023 11:05 AM

    Have you found this Blog post by Florian Baaske? Lots of great information here for AP authentication methods: https://www.flomain.de/2020/03/aruba-ap-authentication/



    ------------------------------
    Dustin Burns

    Lead Mobility Engineer @Worldcom Exchange, Inc.

    ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
    If my post was useful accept solution and/or give kudos
    ------------------------------



  • 3.  RE: IAP 505 802.1x Uplink

    Posted May 11, 2023 01:58 PM

    Yes, i know this post, but i have tried several things. No one is working.
    One cert with priv key and user part in one file like the description in the Aruba Instant User Guide.
    Another test was the same as Florian describes in his post with one file for priv key and another file with user cert. The priv key was encrypted. 

    I can upload the CA part and the user part. When i check it with "sh ap1xca" i can see the rootCA, intermediate certificate and the user cert. 

    All certs are uploaded in PEM format. 

    But when i´m uploading the priv key, i can the with "sh log debug" the following error message:




  • 4.  RE: IAP 505 802.1x Uplink

    Posted May 11, 2023 02:10 PM

    Did you combine the private key and certificate together into one PEM?



    ------------------------------
    Dustin Burns

    Lead Mobility Engineer @Worldcom Exchange, Inc.

    ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
    If my post was useful accept solution and/or give kudos
    ------------------------------



  • 5.  RE: IAP 505 802.1x Uplink

    Posted May 11, 2023 02:17 PM

    Yes of course. This was my first try.




  • 6.  RE: IAP 505 802.1x Uplink

    Posted May 11, 2023 02:38 PM

    I tried a new test with priv key and cert in one file.
    This is the entry in the debug log




  • 7.  RE: IAP 505 802.1x Uplink

    Posted May 12, 2023 05:57 AM

    Looks like the private key cannot be read/decrypted. You could try to upload the certificate over the WebUI (after you cleared the one giving trouble) and see if that works better, or try to import the certificate without private key encryption to see if that makes any difference. Otherwise, it may be needed to check your key material which I would not recommend to share in a public forum.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 8.  RE: IAP 505 802.1x Uplink
    Best Answer

    Posted May 12, 2023 07:26 AM

    I found the error.

    As i wrote above, I have tried several things.
    Now i convert the exported pfx file to one file with the user cert in PEM format and the privat Key in PKCS#8 format. 
    All certs in one file, upload via CLI and after upload reboot the IAP.

    Now i can see the result with "sh ap1x config"


    After activating 802.1x on the switch site, the IAP is successful authenticated.