WiFi wpa_supplicant Configuration

# Load network secrets (required for ISE API access)
dsource d000 dev/network

# Or using eval directly
eval "$(DSEC_EVAL_VERIFIED=true dsec source d000 dev/network)"

# List all NADs
netapi ise -f json get-nads

# Get specific NAD details (e.g., WLC)
netapi ise -f json get-nad -n "Home-9800-WLC"

{
  "name": "Home-9800-WLC",
  "modelName": "9800-WLC",
  "NetworkDeviceIPList": [{"ipaddress": "10.50.1.40", "mask": 32}],
  "NetworkDeviceGroupList": ["Device Type#All Device Types#Wireless Controller"]
}

# List all authorization profiles
netapi ise -f json get-authz-profiles

# Get specific profile details
netapi ise -f json get-authz-profile -n "Linux_EAPTLS_Permit"

# Filter for WiFi-related profiles
netapi ise -f json get-authz-profiles | jq '.[] | select(.name | test("WiFi|Wireless|AP_"; "i"))'

# Get session by MAC address
netapi ise mnt -f json session <MAC>

# Check recent authentications
netapi ise mnt -f json authentications --records 20

# Filter by authentication method
netapi ise mnt -f json sessions | jq '.[] | select(.authentication_method == "dot1x")'

# =============================================================================
# WiFi 802.1X EAP-TLS Configuration
# =============================================================================
# SSID:        Domus-Secure
# Policy Set:  Corp WIFI
# Auth Method: EAP-TLS (certificate-based)
# Target:      Linux workstations with machine certificates
# =============================================================================

ctrl_interface=/run/wpa_supplicant
ctrl_interface_group=wheel
update_config=1
ap_scan=1
fast_reauth=1

network={
    # --- Network Identity ---
    ssid="Domus-Secure"

    # --- Security Settings ---
    key_mgmt=WPA-EAP
    eap=TLS

    # --- Certificate Configuration ---
    # Identity: Machine FQDN matching certificate CN
    identity="modestus-p50.inside.domusdigitalis.dev"

    # Root CA: Validates ISE server certificate
    ca_cert="/etc/ssl/certs/HOME-ROOT-CA.pem"

    # Client certificate: Machine identity for EAP-TLS
    client_cert="/etc/ssl/certs/modestus-p50-eaptls.pem"

    # Private key: Protected by file permissions (0600 root:root)
    private_key="/etc/ssl/private/modestus-p50-eaptls.key"

    # --- Priority ---
    # Higher value = preferred network
    priority=10
}

# Check current DNS server
cat /etc/resolv.conf

# Test resolution of critical services
nslookup ise-01.domain.tld
nslookup ise-02.domain.tld
nslookup keycloak-01.domain.tld    # Or ADFS server
nslookup ca.domain.tld             # Certificate Authority

# Find active connection name
nmcli connection show --active

# Set DNS server (use your internal DNS/pfSense)
sudo nmcli connection modify "CONNECTION_NAME" ipv4.dns "10.50.10.1"
sudo nmcli connection modify "CONNECTION_NAME" ipv4.ignore-auto-dns yes

# Apply changes (WARNING: Will briefly disconnect - run locally, not via SSH)
sudo nmcli connection up "CONNECTION_NAME"

# Verify
cat /etc/resolv.conf
nslookup keycloak-01.domain.tld

# Copy ROOT CA to system trust anchors
sudo cp /etc/ssl/certs/HOME-ROOT-CA.pem /etc/ca-certificates/trust-source/anchors/

# Update system trust store
sudo update-ca-trust

# Verify installation
trust list | grep -i "HOME-ROOT"

# Find Firefox profile directory
ls ~/.mozilla/firefox/ | grep default

# Import ROOT CA (replace profile name)
certutil -d sql:$HOME/.mozilla/firefox/<profile>.default-release \
  -A -t "CT,C,C" -n "HOME-ROOT-CA" \
  -i /etc/ssl/certs/HOME-ROOT-CA.pem

# Verify import
certutil -d sql:$HOME/.mozilla/firefox/<profile>.default-release -L | grep HOME

# Restart Firefox after import
pkill -9 firefox && firefox &

# Chrome uses ~/.pki/nssdb
certutil -d sql:$HOME/.pki/nssdb \
  -A -t "CT,C,C" -n "HOME-ROOT-CA" \
  -i /etc/ssl/certs/HOME-ROOT-CA.pem

# Copy to ca-certificates directory
sudo cp HOME-ROOT-CA.pem /usr/local/share/ca-certificates/HOME-ROOT-CA.crt

# Update trust store
sudo update-ca-certificates

# Verify
grep -r "HOME-ROOT" /etc/ssl/certs/

# Check EKU - MUST show "TLS Web Client Authentication"
openssl x509 -in /etc/ssl/certs/modestus-p50-eaptls.pem -noout -text | grep -A1 "Extended Key Usage"

# Verify certificate chain
openssl verify -CAfile /etc/ssl/certs/HOME-ROOT-CA.pem /etc/ssl/certs/modestus-p50-eaptls.pem

# Check expiration
openssl x509 -in /etc/ssl/certs/modestus-p50-eaptls.pem -noout -dates

# Check subject CN
openssl x509 -in /etc/ssl/certs/modestus-p50-eaptls.pem -noout -subject

# Kill any existing wpa_supplicant for wlan0
sudo pkill -f "wpa_supplicant.*wlan0"

# Remove stale socket
sudo rm -f /run/wpa_supplicant/wlan0

# Bring interface up
sudo ip link set wlan0 up

# Restart wpa_supplicant
sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant-wifi-wlan0.conf -d

# Check network status
sudo wpa_cli -i wlan0 list_networks

# If network shows [TEMP-DISABLED], re-enable it
sudo wpa_cli -i wlan0 enable_network 0

# Force reconnection attempt
sudo wpa_cli -i wlan0 reassociate

# Clean start with debug output
sudo pkill -f "wpa_supplicant.*wlan0"
sudo rm -f /run/wpa_supplicant/wlan0
sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant-wifi-wlan0.conf -d 2>&1 | tee /tmp/wpa.log

# Extra verbose (includes TLS handshake details)
sudo wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant-wifi-wlan0.conf -dd 2>&1 | tee /tmp/wpa.log

wpa_state=ASSOCIATED
Supplicant PAE state=AUTHENTICATING
suppPortStatus=Unauthorized
EAP state=IDLE
selectedMethod=13 (EAP-TLS)

Tunnel-Private-Group-ID=(tag=1) DATA_VLAN
cisco-av-pair: ACS:CiscoSecure-Defined-ACL=#ACSACL#-IP-DACL_SECURE_FULL-696eef59

# Check if WLC has the dACL
netapi wlc run "show ip access-lists"

# Check VLAN exists on WLC
netapi wlc run "show vlan brief"

# Check policy profile AAA settings
netapi wlc run "show wireless profile policy detailed <profile-name>"

# Check client exclusion list
netapi wlc run "show wireless exclusionlist"

# Clear client from exclusion if needed
netapi wlc run "clear wireless exclusion-list 14:f6:d8:7b:31:80"

wireless profile policy POLICY-DOMUS_SECURE
  aaa-override
  nac
  accounting-list ISE-ACCT
  vlan DATA_VLAN

# Add NAC settings to policy profile
curl -sk -u "admin:PASSWORD" -X PATCH \
  "https://WLC-IP/restconf/data/Cisco-IOS-XE-wireless-wlan-cfg:wlan-cfg-data/wlan-policies/wlan-policy=POLICY-DOMUS_SECURE" \
  -H "Content-Type: application/yang-data+json" \
  -d '{
    "Cisco-IOS-XE-wireless-wlan-cfg:wlan-policy": {
      "nac": true,
      "nac-type": "nac-support-radius",
      "accounting-list": "ISE-ACCT"
    }
  }'

# List all dACLs
netapi ise get-dacls

# Get specific dACL content
netapi ise get-dacl -n "DACL_SECURE_FULL"

# Create dACL with permit any
netapi ise create-dacl -n "DACL_SECURE_FULL" --acl "permit ip any any"

# Create restrictive dACL
netapi ise create-dacl -n "DACL_IOT_RESTRICTED" \
  --acl "permit udp any any eq 53,permit tcp any any eq 443,deny ip any any"

# Wrong - case mismatch
802.1x authentication list name: ISE-AUTH

# Correct - matches method list exactly
802.1x authentication list name: ISE-Auth

# Check WLAN settings
netapi wlc run "show wlan name Domus-Secure"

# Check authentication method lists
netapi wlc run "show aaa method-lists authentication"

# Check RADIUS server status
netapi wlc run "show aaa servers"

Failure Reason: 22045 Identity policy result is configured for password
based authentication methods but received certificate based authentication request

Failure Reason: 15039 Rejected per authorization profile

# WRONG - This removes HomeRF from the condition!
Called-Station-ID ENDS_WITH Domus-Secure

# CORRECT - Preserves existing SSIDs
Called-Station-ID ENDS_WITH HomeRF OR
Called-Station-ID ENDS_WITH Domus-Secure

# List authentication rules for a policy set
netapi ise get-auth-rules "Corp WIFI"

# List authorization rules for a policy set
netapi ise get-authz-rules "Corp WIFI"

# Add authentication rule if missing
netapi ise add-auth-rule "Corp WIFI" \
  --name "EAP_TLS_Certificate_Auth" \
  --condition "EapAuthentication == EAP-TLS" \
  --identity-source "AD_Cert_Profile" \
  --rank 0

# Add authorization rule if missing
netapi ise add-authz-rule "Corp WIFI" \
  --name "EAP_TLS_Trusted_Users" \
  --condition "EapAuthentication == EAP-TLS" \
  --profile "Domus_Secure_Profile" \
  --rank 0

# Check if endpoint is rejected
netapi ise get-rejected-endpoints

# Release endpoint from rejection
netapi ise release-rejected 14:f6:d8:7b:31:80

$ sudo wpa_cli -i wlan0 status
bssid=78:bc:1a:36:82:cc
freq=5260
ssid=Domus-Secure
id=0
mode=station
wifi_generation=5
pairwise_cipher=CCMP
group_cipher=CCMP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=COMPLETED
p2p_device_address=14:f6:d8:7b:31:81
address=14:f6:d8:7b:31:80
Supplicant PAE state=AUTHENTICATED
suppPortStatus=Authorized
EAP state=SUCCESS
selectedMethod=13 (EAP-TLS)
eap_tls_version=TLSv1.2
EAP TLS cipher=ECDHE-RSA-AES256-GCM-SHA384
tls_session_reused=0
ieee80211ac=1

# Get WiFi interface MAC
WIFI_MAC=$(ip link show wlan0 | grep ether | awk '{print $2}')
echo "WiFi MAC: $WIFI_MAC"

# Query ISE for session
netapi ise mnt -f json session "$WIFI_MAC"

{
  "calling_station_id": "14:F6:D8:7B:31:80",
  "framed_ip_address": "10.50.40.xxx",
  "user_name": "modestus-p50.{domain}",
  "nas_ip_address": "10.50.1.40",
  "nas_port_type": "Wireless - IEEE 802.11",
  "authentication_method": "dot1x",
  "selected_authz_profiles": "Linux_EAPTLS_Permit"
}

# Get both MACs
WIRED_MAC=$(ip link show enp0s31f6 | grep ether | awk '{print $2}')
WIFI_MAC=$(ip link show wlan0 | grep ether | awk '{print $2}')

# Query both sessions
echo "=== Wired Session ==="
netapi ise mnt -f json session "$WIRED_MAC" | jq '{mac: .calling_station_id, ip: .framed_ip_address, nas: .nas_ip_address, method: .authentication_method}'

echo "=== WiFi Session ==="
netapi ise mnt -f json session "$WIFI_MAC" | jq '{mac: .calling_station_id, ip: .framed_ip_address, nas: .nas_ip_address, method: .authentication_method}'

# Recent authentications for this endpoint
netapi ise mnt -f json authentications --records 20 | \
  jq --arg mac "$WIFI_MAC" '.[] | select(.calling_station_id | test($mac; "i"))'

# Check for failures
netapi ise mnt -f json failed --records 10 | \
  jq --arg mac "$WIFI_MAC" '.[] | select(.calling_station_id | test($mac; "i"))'