• State TI Thinks Resolved
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 40 subscribers
  • Views 669 views
  • Users 0 members are here
Support feedback
Options
Options
Related

This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

CC3120: How to use 802.1x without certificates

Iain Maclean
Prodigy 80 points
Part Number: CC3120
Other Parts Discussed in Thread: CC3220SF-LAUNCHXL

We are using the CC3120R device and have two possible ways to update the product firmware over the air. One uses WPA2_PSK with a SSID and a key and that works very well. The second is to use an enterprise connection, 802.1x with SSID, user name and password. The documentation details about using private keys and certificate's etc but we want to just use the user name and password, this is how the server has been setup.

The following code is used to setup and start the connection  

        sec_params.Type = SL_WLAN_SEC_TYPE_WPA_ENT;
        sec_params.Key = (signed char*)system_get_ssid_key(index);
        sec_params.KeyLen = system_get_ssid_keylen(index);
        eap_params.User = (signed char*)system_get_ssid_username(index);
        eap_params.UserLen = system_get_ssid_username_length(index);
        eap_params.EapMethod = SL_WLAN_ENT_EAP_METHOD_PEAP0_MSCHAPv2;
        status = sl_WlanConnect((const signed char *) system_get_ssid_name(index), system_get_ssid_namelen(index), 0, &sec_params, &eap_params);
         

but it always fails and reports name, password or certificate has caused the fail.

The question I have is can we use 802.1x with having any private keys and certificates in the CC3120?

If so, what should we be doing that we are not doing correctly. 

  • 0
    TI__Mastermind 22935 points

    Hi Iain,

    Try the SL_WLAN_ENT_EAP_METHOD_TTLS_TLS EAP method. And double check your parameters since I cannot see the variables you are using.

    Jesu

  • 0 in reply to Jesu
    Prodigy 80 points

    I tried changing to

    eap_params.EapMethod = SL_WLAN_ENT_EAP_METHOD_TTLS_TLS;

    but it did not make any difference, it still does not connect and process fails.

    I am sure it is sending the correct parameters as I have added debugging and checked them before the call to sl_WlanConnect().

    I also found in document swru455l section 4.6.2 a command for cancelling server authentication and I added that before the setup and start the connection code in previous post. It also did not make it work.

    Do we need to wait a specific period of time for the connection process to be established. 

  • 0 in reply to Iain Maclean
    TI__Mastermind 22935 points

    Apologies for the delay. Most of the office was out for the holidays but we are back now.

    I agree. It looks like you are making the correct.

    Were you able to solve the issue or do you still need assistance?

    Jesu

  • 0 in reply to Jesu
    Prodigy 80 points

    Thanks for the reply.

    I have not been able to solve the issue i also tried having a longer timeout/waiting for connection period but it made no difference.

    If it helps we are using a MSP432P4111IPZ connected to CC3120RNMARGK via simplelink for wi-fi, we are using SimpleLink MSP432P4 SDK-2.40.0.10 and SimpleLink SDK WiFi Plugin- 2.40.0.22.

    The normal operation on wi-fi works and the connection for the over the air update using WPA2_PSK also works but when configured for PEAP_MSCHAPv2_802_1X it fails to connect. They are using the same function to connect just passing in different parameters adding the enterprise parameters where required.  

    We have also checked that we can connect to the enterprise network via other devices i.e. mobile phone using the parameters we are passing in.

    I have inherited this project as previous engineers have left and don't know the full development history, but its based on CC3220SF-LAUNCHXL and CC3120-BOOST starter packs and associated software.

    Any further help would be greatly appreciated.

    Iain

  • 0 in reply to Iain Maclean
    TI__Mastermind 22935 points

    Hi Iain,

    I just want to make sure I understood. You want to use enterprise security with no certificates at all? 

    I don't think this is possible. If you use EAP TLS you need a client certificate and a server certificate. Other enterprise security methods require at least a server certificate.

    Jesu

  • 0 in reply to Jesu
    Prodigy 80 points

    Hi  Jesu

    Yes that correct, we do not want to implement server and client certificates and private keys on the device. My understanding is that the server has been set up to send a certificate in response but to get access we just need to send a SSID, Username and password.

    Iain 

  • 0 in reply to Iain Maclean
    TI__Mastermind 22935 points

    Okay. This makes more sense. What is the return value of the WLAN connect call? I don't see anything wrong with your code. 

    Also, have you tried capturing air sniffer logs to see if the server is actually serving the certificate during the negotiation? At this point I'm trying to verify the server is actually serving the certificate.

    Jesu

  • 0 in reply to Jesu
    Prodigy 80 points

    Hi

    The return from the sl_WlanConnect() is zero (SUCCESS) as this seems to be just sending the data to the cc3120 and we then sit in state machines waiting on SimpleLink event handler callbacks to indicate it has been connected and moving the state machines on.

    As it sits waiting it is checking one of the state machines and looking for the state to go to connected state, set by the event callbacks, but it never does and so after a number of retries of checking this, it flags an error and the process ends.

    We have not tried to capture any air sniffer logs but have confirmed that the parameters being sent in the sl_WlanConnect() are correct for what we are trying to connect to.        

  • 0 in reply to Iain Maclean
    TI__Mastermind 22935 points

    Hi.

    Thanks for the response. I agree that your SW seemingly looks good. At this point I would verify your server is correctly setup to send the certificate and capture air logs to check what happens during the handshake procedure.

    Jesu