RCA-2026-03-13-001: WiFi EAP-TLS DHCP Failure

# WPA2-PSK (Personal/Hotspot) - Most Common
nmcli c add type wifi con-name "Connection-Name" \
  ssid "Network-SSID" \
  wifi-sec.key-mgmt wpa-psk \
  wifi-sec.psk "YourPassword" \
  ipv4.method auto \
  connection.autoconnect no

# WPA3-Personal (newer, more secure)
nmcli c add type wifi con-name "WPA3-Home" \
  ssid "WPA3-Network" \
  wifi-sec.key-mgmt sae \
  wifi-sec.psk "YourPassword"

# EAP-TLS (802.1X Enterprise)
nmcli c add type wifi con-name "Corp-WiFi" \
  ssid "Corporate-SSID" \
  wifi-sec.key-mgmt wpa-eap \
  802-1x.eap tls \
  802-1x.identity "user@domain.com" \
  802-1x.client-cert "/etc/ssl/certs/user.crt" \
  802-1x.private-key "/etc/ssl/private/user.key" \
  802-1x.ca-cert "/etc/ssl/certs/ca.crt" \
  wifi.cloned-mac-address permanent

# EAP-PEAP/MSCHAPv2 (username/password enterprise)
nmcli c add type wifi con-name "PEAP-WiFi" \
  ssid "Enterprise-SSID" \
  wifi-sec.key-mgmt wpa-eap \
  802-1x.eap peap \
  802-1x.phase2-auth mschapv2 \
  802-1x.identity "username" \
  802-1x.password "password" \
  802-1x.ca-cert "/etc/ssl/certs/ca.crt"

# Change IP configuration (static)
nmcli c mod "Connection" ipv4.method manual
nmcli c mod "Connection" ipv4.addresses "10.50.1.201/24"
nmcli c mod "Connection" ipv4.gateway "10.50.1.1"
nmcli c mod "Connection" ipv4.dns "10.50.1.90,10.50.1.91"

# Switch to DHCP
nmcli c mod "Connection" ipv4.method auto
nmcli c mod "Connection" ipv4.addresses ""
nmcli c mod "Connection" ipv4.gateway ""
nmcli c mod "Connection" ipv4.dns ""

# Fix MAC randomization (required for EAP-TLS)
nmcli c mod "Connection" wifi.cloned-mac-address permanent

# Enable MAC randomization (privacy for public networks)
nmcli c mod "Connection" wifi.cloned-mac-address random

# Increase DHCP timeout (default is 45s)
nmcli c mod "Connection" ipv4.dhcp-timeout 120

# Set connection priority (higher = preferred)
nmcli c mod "Connection" connection.autoconnect-priority 100

# Set route metric (lower = preferred for routing)
nmcli c mod "Connection" ipv4.route-metric 50

# Delete connection
nmcli c delete "Connection-Name"

# Export connection to file
nmcli c export "Connection-Name" > connection.nmconnection

# Import connection from file
sudo cp connection.nmconnection /etc/NetworkManager/system-connections/
sudo chmod 600 /etc/NetworkManager/system-connections/connection.nmconnection
sudo nmcli c reload

# List all saved connections
nmcli c show

# List active connections only
nmcli c show --active

# Show connection details
nmcli c show "Connection-Name"

# Show WiFi-specific settings
nmcli c show "Connection-Name" | grep -E 'wifi|802-1x|ipv4'

# Scan for available networks
nmcli d wifi rescan && nmcli d wifi list

# Show WiFi device status
nmcli d show wlan0

# Get WiFi interface MAC address
nmcli -g GENERAL.HWADDR d show wlan0

# NetworkManager logs (last 5 minutes)
journalctl -u NetworkManager --since "5 minutes ago"

# Filter for WiFi interface
journalctl -u NetworkManager --since "10 min ago" | grep -E 'wlan0|wifi'

# Look for IP conflicts
journalctl -u NetworkManager --since "10 min ago" | grep -E 'cannot be configured|already in use'

# wpa_supplicant logs (EAP authentication)
journalctl -u wpa_supplicant --since "10 min ago"

# Filter for auth events
journalctl -u wpa_supplicant --since "10 min ago" | grep -E 'CTRL-EVENT|EAP|associated'

# Real-time log monitoring
journalctl -u NetworkManager -f

# Check DNS resolution
dig @10.50.1.90 google.com +short

# Verify IP and routing
ip -4 addr show wlan0
ip route | grep wlan0

# Set WiFi as backup to wired (higher metric = lower priority)
nmcli c mod "WiFi-Connection" ipv4.route-metric 200
nmcli c mod "Wired-Connection" ipv4.route-metric 100

# Set connection priority (for autoconnect selection)
nmcli c mod "Preferred-WiFi" connection.autoconnect-priority 100
nmcli c mod "Backup-WiFi" connection.autoconnect-priority 50

# Connect to hidden SSID
nmcli c add type wifi con-name "Hidden-Network" \
  ssid "Hidden-SSID" \
  wifi.hidden yes \
  wifi-sec.key-mgmt wpa-psk \
  wifi-sec.psk "password"

# List all WiFi connections
nmcli -t -f NAME,TYPE c show | awk -F: '$2=="802-11-wireless" {print $1}'

# Delete all WiFi connections matching pattern
nmcli -t -f NAME,TYPE c show | awk -F: '$2=="802-11-wireless" && $1~/Guest/ {print $1}' | \
  xargs -I {} nmcli c delete "{}"

# Export all WiFi connections
nmcli -t -f NAME,TYPE c show | awk -F: '$2=="802-11-wireless" {print $1}' | \
  while read conn; do nmcli c export "$conn" > "${conn}.nmconnection"; done

# List connections with their UUIDs
nmcli -t -f NAME,UUID,TYPE c show | awk -F: '$3=="802-11-wireless" {printf "%-30s %s\n", $1, $2}'

# Find connections using specific SSID
nmcli -t -f NAME,802-11-wireless.ssid c show | awk -F: '$2=="Target-SSID" {print $1}'

# One-shot signal check
nmcli -f SSID,SIGNAL d wifi list | awk 'NR>1 {print $1, $2"%"}' | sort -t'%' -k2 -nr

# Continuous monitoring (every 2 seconds)
watch -n 2 'nmcli -f SSID,SIGNAL,BARS d wifi list'

# Log signal strength over time
while true; do
  nmcli -t -f SSID,SIGNAL d wifi list | grep "^YourSSID:" | \
    awk -F: -v ts="$(date +%H:%M:%S)" '{print ts, $2"%"}'
  sleep 10
done >> wifi-signal.log