topic Re: AP2600 problem with Android 11 in ExtremeWireless (General)

AP2600 problem with Android 11

uwcd — Thu, 26 Aug 2021 12:47:44 GMT

Hi,

Users with android 11 cannot connect to our wifi network. We are using AP2600 Platform.
NAC version is 6.3.0.186
Controller is V2110 Medium, system version is 09.21.20.0001
Is there any option in extreme?

I tried to generate and upload a certificate but it didn’t help.

Re: AP2600 problem with Android 11

Miguel-Angel_RO — Thu, 26 Aug 2021 14:55:58 GMT

Aren’t you facing this issue?:

https://httptoolkit.tech/blog/android-11-trust-ca-certificates/

Re: AP2600 problem with Android 11

StephanH — Thu, 26 Aug 2021 15:30:47 GMT

Hello uwcd,

which method do you use for authentication in the WLAN? EAP-TLS, PEAP? If yes, have you already used pre-shared keys to narrow down the error?

Re: AP2600 problem with Android 11

uwcd — Thu, 26 Aug 2021 15:31:28 GMT

Dear Miguel,

Thank you for your reply. Yes we have the same issue. I tried to install the certificate on the Android 11 phone, selected the certificate on the connection settings page but cannot connect to the WiFi. Yes, we are using PEAP. It is working with pre-shared key, but we need to use user authentication method, as we have different VLANs with different access rights for different users (students, teachers, staff)

Re: AP2600 problem with Android 11

Miguel-Angel_RO — Thu, 26 Aug 2021 15:35:33 GMT

Please double check this: https://extremeportal.force.com/ExtrArticleDetail?an=000092023

and ensure the domain entered is matching the domain of the certificate

Re: AP2600 problem with Android 11

StephanH — Thu, 26 Aug 2021 15:37:16 GMT

Assuming you are using 802.1x with PEAP. Have you also installed all intermediate certificates? So the whole chain?

Re: AP2600 problem with Android 11

uwcd — Thu, 26 Aug 2021 17:34:29 GMT

Yes, we are using 802.1x with PEAP andself-signed certificate .

Re: AP2600 problem with Android 11

StephanH — Thu, 26 Aug 2021 19:26:42 GMT

What do you see in the NAC log for the authentication session of the Android 11 device?

Re: AP2600 problem with Android 11

Miguel-Angel_RO — Thu, 26 Aug 2021 23:21:06 GMT

Could you share a screen of you AAA config (including Trusted Authorities) and the certificate screen in the details of the Control Engine for the Radius Certificate?

What is the result of the configuration evaluation tool for such kind of client?

Mig

Re: AP2600 problem with Android 11

uwcd — Fri, 27 Aug 2021 18:22:09 GMT

Here are the screenshots

Re: AP2600 problem with Android 11

Miguel-Angel_RO — Wed, 01 Sep 2021 15:44:15 GMT

Hi uwcd,

Sorry for this late answer.

I see now that your NAC version is very old I din’t noticed thispreviously.

Anyway, what is the certificate used by the control for the radius authentication?

Mig

Re: AP2600 problem with Android 11

uwcd — Wed, 01 Sep 2021 16:27:11 GMT

Hi Mig,

Thank you for your answer, as I said, we are using self signed certificate but I have tied with Sectigo RSA SSL certificate also. I applied it to the access point and installed the certificate on Android 11 phone. Unfortunately it is not working. For a self signed certificate there is no option to enter the domain name while generating CA request

Re: AP2600 problem with Android 11

Miguel-Angel_RO — Wed, 01 Sep 2021 21:25:13 GMT

uwcd,

I’m talking about the certificate used by the control and presented to the clients.

You can check that on the webview of the control (at least for v8.5).

Mig

Re: AP2600 problem with Android 11

StephanH — Thu, 02 Sep 2021 09:01:56 GMT

Hi uwcd,

to give some background on MIG's question. When radius authenticating (via 802.1X) WLAN clients on an infrastructure consisting of the Extreme WLAN controller and a NAC, the authentication takes place at the NAC and not at the WLAN controller. Thus, the certificate on the NAC is relevant. This is checked by the client.

The NAC works as authentication server, the controller together with the AP as authenticator and your client is the supplicant.

Re: AP2600 problem with Android 11

uwcd — Mon, 13 Sep 2021 18:10:51 GMT

Dear @StephanH and @Miguel-Angel RODRIGUEZ-GARCIA ,

Sorry for the late reply. As I said in my first message, We are using AP2600 Platform.
NAC version is 6.3.0.186 . There is no such option.