WPA3 entreprise with EAP-TTLS-MSCHAPv2 is not working

[MOHAMED Kallel]

I am evaluating the board nrf3054-dk + nrf7002-ek

I build and run the sample project  net/samples/wifi/shell on my board

when I compiled the project, I added the following params to proj.conf in order to support wpa3 enterprise:

CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE=y
CONFIG_WIFI_NM_WPA_SUPPLICANT_WPA3=y

I have AP configured with WPA3 enterprise

I tried to connect my board nrf3054-DK + nrf7002-EK with the following command:

uart:~$ wifi connect -s "RYSE-SmartBridge-4B19" -k 14 -S 3 -w 2 -I "bob" -P "test"

- k 14 : EAP-TTLS-MSCHAPv2

but the connection fails.
what I am missing ?

[Samruddhi Jadhav]

Hi,

It seems like you are trying to use EAP-TTLS which requires TLS and CA certificate. 

In proj.conf, you need to also enable EAP and TTLS support. Try with the following:

CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP=y

CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP_TTLS=y

CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP_MSCHAPV2=y

In addition to this, you have to make sure Zephyr TLS and mbedTLS are enabled. You also have to get the CA certificate used by your WiFi or RADIUS server and add it to the firmware. Ensure that PMF isn't disabled. In the command that you are using, typically both outer identity and inner identity are needed. Using only one may also result in EAP failure. 

Let me know if you have any further questions. 

[MOHAMED Kallel]

thank you for your feedback

I already tested the wifi shell program with WPA2 ent and it worked without adding the params you specified in your feedback

CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP=y
CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP_TTLS=y
CONFIG_WIFI_NM_WPA_SUPPLIANT_EAP_MSCHAPV2=y

and it worked without adding certificates on the nrf device

but when I tested the program with wpa3 then it fails.

btw, I added these param in proj.conf but the compilation fails with the following info:

attempt to assign the value 'y' to the undefined symbol
WIFI_NM_WPA_SUPPLICANT_EAP
WIFI_NM_WPA_SUPPLICANT_EAP_TTLS

and also my command already contains the MFP enabled as you can see in my command: -w 2
and by default theccommad ignore the cert check(default behaviour)

[Samruddhi Jadhav]

Hi,

The experts that can look into this issue are away until New Year. Therefore, there may be some delays in response times. We will respond to you as soon as they are back.

Thank you for your patience.

[Amanda Hsieh]

Hi, 

Could you build the shell sample with "shell_SNIPPET=wifi-enterprise, CONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y , and CONFIG_LOG_MODE_IMMEDIATE=y" to test and provide the log? See https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.html#build_the_nrf70_series_dk_for_shell_sample_with_enterprise_mode

Regards,
Amanda H.