topic Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C in ExtremeWireless (General)

Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Mon, 23 Sep 2024 10:06:32 GMT

Hello Community,

I have an issue with Apple devices connecting to Extreme 305C AP's. The Apple devices when connecting to an Extreme 305C AP should bring up a certificate which is then trusted. This is not happening.

I have 2x AP controllers in use. The other controller brings up the certificate for the same connecting device albeit connecting to a non Extreme AP.

I have checked all the Radius and NPS settings and these are similar for the old and new AP's.

I am using Extreme Cloud IQ for management of the Extreme 305C AP's.

I will summarise below:

What is working:

Apple and Android device connecting to the old controller and a different brand AP.
This brings back the certificate which is then trusted.
I can see the user details in the Radius logs.
Access is available.

What is not working:

Apple devices connecting to Extreme 305C AP's.
Android devices work OK with a certificate prompt.
No certificate prompt.
No details in Radius logs.
Says Cannot connect to this network.

Any thoughts on this please?

Thanks,

Asif

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

AntonScholz — Mon, 23 Sep 2024 12:28:25 GMT

Hi Asif,

If you do a packet capture, can you see any EAP-Packets ?! Or only discovery and association.

Because Android devices work, this sounds to me like compatibility problems between your Apple Devices and your Wireless Settings.
Please deactivate all none essential features like 802.11 w,r,k,mc and try it again.

The certificate shouldn't be part of the 802.1x authentication. I know, with BYOD and self-signed certificates it's difficult to implement.
Try to pre-install and trust the Radius-Cert or the signing CA-Cert.

Best Regards
Anton Scholz

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Mon, 23 Sep 2024 13:50:45 GMT

Hello @AntonScholz (Anton)

Do you mean a wcap capture. Sorry, I'm new with these AP's so will need to work out what's where etc?

Thanks,

Asif

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Mon, 23 Sep 2024 14:02:09 GMT

HI Anton,

I am also seeing some security policy issues please see below. However, I have searched and cannot see where this security is or what this relates to. However, it is on the SSID I am having issues with.

Thanks,

Asif

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

Bartek — Tue, 24 Sep 2024 09:35:19 GMT

Important question - do you see authentication requests in Event Log for NPS service? "Client Denied by Security" looks like problems with STA associations

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Tue, 24 Sep 2024 10:48:54 GMT

Hello @Bartek

I can see in the NPS server logs that the NPS granted access to a user and Audit Success.

However, as previously stated, for Apple devices using the Extreme AP's, the certificate option does not appear and I see the "Unable to join this network" message. However, using our other Fortinet AP's the same Apple device connects and the certificate appears and is trusted with no issues.

Thanks,

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

AntonScholz — Tue, 24 Sep 2024 12:31:13 GMT

Hi Asif,

The Packet-Capture is under:
Manage -> Client Monitor & Diagnose -> Packet Capture

With this, you can capture all traffic at different interfaces from all managed Wifi-APs you want.
I recommend capturing at the wireless interface.

Thanks for your update.
This message appears normally when any security setting in your SSID denies the Client.
Please check the following in your used SSID.

Configure -> Network Policy -> YOUR-POLICY -> STAGE 2 WIRELESS -> YOUR-SSID -> Additional Settings (At the buttom):

Advanced Access Security Controls -> 802.11w (Protected Management Frame) enabled ? -> Try with disabled -> Older Clients don't support this option

Optional Settings -> Following enabled ? -> Try with disabled

Enable 802.11k
Enable 802.11v
Enable 802.11r

Optional Settings -> DOS Prevention -> MAC Filtering enabled? -> Disable it or change the sequence (SSID before MAC)

Last talk about the NPS.
Do you have a separate Policy for the Apple Client?
There are differences between the Android and the Apple Policy? (EAP-Settings, Certificate, Returned Attributes)?

Best Regards

Anton Scholz

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Tue, 24 Sep 2024 13:09:54 GMT

Hello @AntonScholz

Many thanks for your email reply. I have captured the packets and have downloaded the captures. I noticed the protocol 802.11w was enabled. However, I cannot toggle the switch to turn this off please see screenshot below. Any ideas how I can do this please?

All the other protocols are not enabled.

I do not have a separate Apple policy within NPS. My original policy that supports the Fortinet AP's works with both Apple and Android clients with no issues and uses a wildcard certificate.

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

AntonScholz — Tue, 24 Sep 2024 13:25:22 GMT

Hello Asif,

If you use a WPA3-Enterprise Network the 802.11w is a necessity and cannot be disabled.
Please try it with a WPA2-Enterprise authenticated network.
You wrote you use the NPS from Microsoft as Radiusserver. A wildcard certificate will always result in a certificate issue, because the Hostname must match exactly with the common name in the certificate. Wildcards are not valid here.

I'm looking forward to hearing from you.

Regards

Anton Scholz

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Tue, 24 Sep 2024 15:37:27 GMT

Hello @AntonScholz

Disabling the 802.11w looks to be working for me. I will also have a look at the certificate name in due course. I'll test over the next couple of days to be certain.

Many thanks for your help and suggestions on this issue.

Kind Regards,

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

Bartek — Thu, 26 Sep 2024 08:46:15 GMT

Apple devices have some issues with WPA3 and I've heard about it from Extreme SE. From my in-field tests on customer site with AP305C (mostly macs) WPA2 with 802.11w is fine (tested with MacBook Air 2017 and new M1/M2) but be cautious with older devices (Mac mini from 2012 seems that doesn't support it and some Windows machines). Preauthentication and proactive PMK-ID response settings seems working fine.

Re: Apple devices not bringing up certificate when connecting via WIFI using Extreme AP 305C

ExtremeNewbie — Thu, 26 Sep 2024 12:15:05 GMT

Hello @Bartek

Yes I dropped down to WPA2 Enterprise and had to turn off 802.11w for the older iPads we have to connect (ver 12). Didn't work at all with 802.11w enabled I'm afraid.

Thanks,