• State
  • Locked Locked
  • Replies 5 replies
  • Subscribers 39 subscribers
  • Views 1356 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC3200MOD: Trouble connecting to WPA2 Enterprise Network

Tom Becnel
Prodigy 170 points
Part Number: CC3200MOD
Other Parts Discussed in Thread: UNIFLASH, CC3200

Hello,

I am following the ent_wlan project to connect to a WPA2 Enterprise network, but am unable to establish a connection. I have successfully and correctly downloaded the Root CA Certificate in PEM format and verified that it is correct. I have flashed the certificate via UniFlash to /cert/ca.pem as instructed by the TI Wiki page. In main.c, I have changed the ENT_NAME (changed to 'ExampleNetwork', see below), USER_NAME (changed to 'username[AT]example.server.edu', and PASSWORD, and verified they are correct by testing them a computer. I have downloaded the latest ServicePack to the CC3200. 

Below is some relevant information from where I downloaded the CA Root cert:

Wireless Name (SSID): ExampleNetwork
Security Type: WPA2-Enterprise
Encryption Type: AES (CCMP)
EAP Method: EAP-TLS (or TLS)
Root CA Certificate(s): Example Company Root CA I
Server Name: radius.example.edu
Client Certificate: username@example.server.edu
Username: username@example.server.edu

I have specified the EAP method with the following:

eapParams.EapMethod = SL_ENT_EAP_METHOD_TTLS_TLS;

sl_WlanConnect() function returns 0, but SimpleLink never sets the flags for IS_CONNECTED() and IS_IP_ACQUIRED(). After several seconds of waiting a general event starts appearing:

[GENERAL EVENT] - ID=[-102] Sender=[5]

I am curious as to if or how I set the appropriate server, in this case 'radius.example.edu', and whether I should be setting the /cert/client.pem and /cert/private.key files through Uniflash. Along with the CA Root certificate I am also given the client certificate and private key as certificate.p12. I have converted these into the client cert (PEM formatted) and private key, and have included them through Uniflash, but to no avail. 

Thank you for any help,

Tom 






  • 0
    TI__Guru 64455 points

    Hello,

    Are you sure about the ebterprise security? Is it TLS-TTLS for sure?

    Basically, the client certificate and key for client authentication are mainly used with TLS (but not neccesarily with TTLS).

    Also password is not really requiered with TTLS (only with PSK or MSCHAPv2).

    Regards,

    Shlomi

  • 0 in reply to Shlomi Itzhak
    Prodigy 170 points

    Hi Shlomi,

    Thank you for your reply. The information I posted was exactly how it appeared on the organization's webpage, so I can only assume that it is correct. 

  • 0
    TI__Guru 64455 points

    OK,

    So in this case it looks to me as EAP-TLS only, not TTLS (i.e. SL_ENT_EAP_METHOD_TLS).

    In TLS only case, you almost sure need the client certificate and the key installed as the server side also authenticate the client.

    /cert/client.pem and /cert/private.key.

    Regards,

    Shlomi

  • 0 in reply to Shlomi Itzhak
    Prodigy 170 points

    I have also tried this with no success. Are there any parameters in the code that need to be set? 

    Tom

  • 0 in reply to Tom Becnel
    TI__Guru 64455 points

    No, for a TLS connection, you should have CA certificate, client certificate and private key programmed to the device in the designated filenames (from Uniflash).

    Also, you would need the username/annonymous (and password if you have one). That's it.

    Do you have a sniffer capture for good and bad case ot any feedback on the server side to see where it fails (although the WiFi connection is secured but maybe we can see that it fails even before it negotiates the EAPOLs)?

    Shlomi