[Q] L2TP/IPSEC VPN settings for server - One (M7) Q&A, Help & Troubleshooting

Hi,
I'm wondering if anyone could help me with the settings that I need to implement for L2TP/IPsec to work with my HTC One?
Basically I have 3 handsets with versions 4.2, 4.3, 4.4 of Android and need to get VPN functionality working.
Previously I was using OpenVPN which worked fine but then version 4.4 of Android managed to break things so the OpenVPN Connect app doesn't work any more.
I think what I'm stuck on is which encryption type works and also authentication type should be?
My server runs OpenBSD so I don't know if anyone has had any luck with that but my current settings are:
main: hmac-sha1 with encryption type aes and modulus of 1024
quick: hmac-sha1 with encryption type aes and psk
I've had a look at some Cisco documentation to try to figure out the necessary settings which are actually the ones above... however I keep getting the error that the "Phase 2 ID's don't match"/
Would someone be able to share their working config experiences so that I can get my handsets to connect?
Basically the issue I'm having is not with the handset but figuring out how to configure the server to get the handset to connect.
Thanks.

Related

wifi & secure w2 certificate problem! which rom?

hello everybody,
i am having huge problems connecting to my university`s wifi (tu-clausthal in germany). i installed secure w2 newest version and the required certificates from my university. i configured everything according to the guidelines. however, i cannot connect to the wifi network, it keeps connecting forever and nothing happens. i am 100% sure the configuration is correct, a friend of mine can connect with the exact same config. also i can connect to any other wifi network, no matter if wep, wpa, etc. only havin problems with the certificates, it seems.
now my question: has anybody successfully connected to a secure w2 wifi network? if so, which rom and which version of secure w2 did you use?
the technical support of my university doesnt know anything about windows mobile...iphone and symbian phones seem to connect without problems...
any suggestions?
edit: i am using AtheniOS rom wm 6.1
Same problem connecting to a w2 on my AT&T Tilt. My company was running a linksys standard WPA but installed a WPA2 a few months ago. My IT department tried to help but they don't know windows mobile and AT&T tech support was useless. I have a WPA2 option in my wireless menu but I can't connect??? I'll get looking and will post if I find anythink.
hmm too bad. as i said, one of my friends can connect without problems....
With WPA2 Enterprise (not WPA2-PSK) Windows Mobile allows only EAP-TLS & PEAP Authentication, the authentication type will be configured on a central RADIUS server(s). With EAP-TLS you MUST have a personal certificate on the device as well as the Root CA's certificate. The client certificate must also have the 'Client Authentication' attribute. The Root CA certificate will generally have the 'All Purposes' attribute. With PEAP you have the option to use either a Certificate or Username/Password to identifiy the user - you would normally use Username/Password, however the RADIUS Server always identifies itself to the client using a Certificate. The client has the option to ignore this certificate if it chooses, however the default is to verify it is a trusted certificate. In XP or Vista you can turn this checking off in the network settings by unchecking the box 'Validate server certificate'. In Windows Mobile there isn't a way of doing this in the GUI, however there is a registry tweak that can be set:
Code:
[HKEY_LOCAL_MACHINE\Comm\EAP\Extensions\25
ValidateServerCert=0
Setting the value to 1 means check the certificate, 0 means don't check it.
Also verify the Time & Date on your device is in sync with the RADIUS server as timing is critical with PKI.
Other than that I don't know what to suggest. I sucessfully use my Kaiser with (almost) stock 5.2.19212 ROM on two WPA2 networks, one using WPA2/AES with PEAP authentication and the other using WPA2/AES & EAP-TLS - both work fine.
One more thing, check the version of the 'TNETW1251.dll' file. There appears to be at least two floating around. I have version 3.55.0.0 in my ROM.
HTH
Andy
thanks for your advice!
i just flashed the new atheniOS win 6.5 and installed the secure w2 software and now it works! i dont know why or how though

Connecting to 802.1x encrypted Wifi

My school has campus-wide wifi that is encrypted using 802.1x enterprise encryption and I can't get my N1 to connect to it. Under the wifi settings the network shows up in range, but it shows up as a WEP wifi connection which isn't the case. I can manually add a connection and choose 802.1x and configure it as it should in order to connect, however when I do that it shows up at the bottom of the list as "Not in range, remembered" despite the fact that the SSID of the same name still shows up as that incorrect WEP encrypted connection.
Has anyone successfully connected to a 802.1x encrypted connection using their N1?
Do you need to install a security cert?
My N1 doesn't arrive until tomorrow, and I haven't tried connecting to my current school's wireless network. My last school had enterprise security, and I had to install a certificate on my laptop, and special software on my Windows mobile.
If no one else gets back to you, I'll see if I can screw around tomorrow evening.
Some googlin' brought up some maybe relevant info:
http://www.google.com/support/forum/p/android/thread?tid=5507f5155591aeda&hl=en
http://www.google.com/support/forum/p/android/thread?tid=4be67146eafe4365&hl=en
ATnTdude said:
Do you need to install a security cert?
My N1 doesn't arrive until tomorrow, and I haven't tried connecting to my current school's wireless network. My last school had enterprise security, and I had to install a certificate on my laptop, and special software on my Windows mobile.
If no one else gets back to you, I'll see if I can screw around tomorrow evening.
Some googlin' brought up some maybe relevant info:
http://www.google.com/support/forum/p/android/thread?tid=5507f5155591aeda&hl=en
http://www.google.com/support/forum/p/android/thread?tid=4be67146eafe4365&hl=en
Click to expand...
Click to collapse
i've tried a few different methods mentioned in the google forums and still no luck...
anyone able to connect using 802.1x?
with 2.1 update 1
i got it to work. not sure if that's what fixed it as my SA gave me the wrong sid the first time ... but it works great post update!
Nexus One -- Android 2.2 and 802.1x WiFi Authentication
flomid said:
My school has campus-wide wifi that is encrypted using 802.1x enterprise encryption and I can't get my N1 to connect to it. Under the wifi settings the network shows up in range, but it shows up as a WEP wifi connection which isn't the case. I can manually add a connection and choose 802.1x and configure it as it should in order to connect, however when I do that it shows up at the bottom of the list as "Not in range, remembered" despite the fact that the SSID of the same name still shows up as that incorrect WEP encrypted connection.
Has anyone successfully connected to a 802.1x encrypted connection using their N1?
Click to expand...
Click to collapse
I am using a stock Nexus One on Android 2.2. I got it running by entering the following (be sure to 'FORGET' the SSID that automatically comes up in favour of manually creating it) at 'Settings' >> WiFI:
EAP method: (I can choose b.w. PEAP, TLS or TTLS) and I choose PEAP
CA certificate: no choice … merely shows in brackets (unspecified)
User certificate: (unspecified)
Identity: (I enter) [MY-USERNAME, e.g., [email protected]]
Anonymous identity: (leave blank)
Password: [MY_PASSWORD]
Our university relies on WPA2/EAP/MS-CHAP .... but in our case putting the entire username did the trick.
I believe the Android 2.1 UI is deficient and will not let you enter the above, and from what I have read those who have 'rooted' their phone (and voided their warranty) have placed something like the following wpa_supplicant.conf file in /etc/wifi :
##### wpa_supplicant configuration file template #####
update_config=1
ctrl_interface=eth0
eapol_version=1
ap_scan=1
fast_reauth=1
Network={
ssid="MY_SSID"
key_mgmt=IEEE8021X
eap=PEAP
phase2="auth=MSCHAPV2"
identity="MY_USERNAME"
password="MY_PASSWORD"
}
Some have mentioned that any certificate (e.g., Thawte) should be .p12 configuration and placed in the root directory of the SD Card. The best info for those who want to 'root' their Nexus one is Joe Levi's commentary at: http://pocketnow.com/tweaks-hacks/video-flashing-froyo-on-your-nexus-one
But as I stated, I have mine running the Net locally, and just need the proxy turned off by the uni. to get out.
Hope this helps.
I'm having the same issue at work. It appears as a WEP network and adding it as 802.1x says the network is not in range.
I'll give that wpa_supplicant.conf hack a go later.
I solved this issue, with the WiFi Advanced Config Editor (available in the marketplace)
my WIFI is 802.1x, with PEAP,MSCHAP v2
connect to the listed wifi with wep enabled, use any password
then modify the configuration with the WiFi Advanced Config Editor set as 802.1x, PEAP, MSCHAP v2, set user identity and password remove and remove any WAP settings
a enjoy
In my case, i have ICS 4.0, i try all suggestions above, but not work.
Someone can help me? Please

[Q]Cannot connect with 802.1x EAP network

I do not know how many people are experiencing this issue but apparently I cannot never ever connect with my school Wifi's network which has security type: 802.1x EAP. It does not work with any Android version I tried (2.1, 2.2, 2.2.1, 2.3.3) and any ROMS (Cronos, HONO CM6/7 mod, Ice&Fire and CM7) weirdly. All it does is just sit there "Connecting and Disconnecting", whenever I forced it to Connect to the network.
Originally I thought it to be an Android bug since all my friends and me who owns an iOS device can connect to the school's network while my other friend who have a Xperia X8 and me with my Milestone can't. However the other day, my friend tried to connect its Optimus One (running stock 2.2) with the network and it connects.
So I take a look at his settings and this is what I got:
Code:
Security Type: 802.1x EAP
EAP: PEAP
Phase 2 Authentication: None
CA & User Certificate: (unspecified)[however in iOS, it will prompt user to install a unknown certificate though for him, no prompt was shown]
Identity: *correct user*
Anonymous identity: blank
Password: *correct password*
I originally thought it was a CM's problem but it seems after trying out other ROMS, it failed to connect to it too. Any help?
http://code.google.com/p/android/issues/detail?id=1386
Thanks for the link, will try some of the workarounds posted in there.
Hmm, are you sure it's PEAP and not something like MSCHAP2 for the authentication? I know my work requires a certificate, which is what allows me to connect; I had to create a p12 certificate, since my work doesn't allow exporting, it was a bit long and arduous using openssl.
However, since you're listing a username and password, it sounds like they can go in without a cert, which, when working with other vendors, was usually specified as mschap2. Still, I'm no expert, so I may be wrong.
If you need to change settings, there is an Advanced Wifi Configuration utility on the market. I'd link it, but evidently my post count is too low.
Yeah it was PEAP, at least according to my friends' Optimus One settings.
Just to report back, after trying out WifiAce and try to tick almost all possible combinations, I unfortunately still unable to connect with my school wifi. The problem is also present in Desire Z. However the LG Optimus One continue to connect without problem. Any ideas?

Not working: 802.1X / WPA2 / PEAP TTLS MSCHAPV2

Hi,
I'm trying to connect to a WiFi network that is protected with WPA2 with PEAP / TTLS.
It simply is not working. No problems connecting with my HTC Desire though.
Anybody experiencing the same bug? I already installed the required root certificates, tried various combinations of user account / password. The thing is, that the network is provided by my university (Eduroam if you are familiar with that) and it is very annoying that I have to fall back to HSDPA consuming my data quota.
Cheers,
chross
Normally with eduroam wifi there isn't wpa2 or other key. Just connect your phone to it, open your browser and you will be redirect to the website of your university and then you can log with your id.
Envoyé depuis mon XT890
Yes!! This is the exact same problem I'm having with my university wifi
http://forum.xda-developers.com/showpost.php?p=33962871&postcount=2
I'd configure the settings on my uni wifi choosing PEAP and then MSCHAPV2 and put in my log in username and password according to the instruction and as soon as press connect or save it looses the signal immediately to very low and never connects. We also have eduroam as an alternative they tried that and same problem just doesn't want to connect.
It works perfect on my htc one x. I'm beginning to believe the phone has a bug.
It does have a bug. It doesn't connect to 802.11 n!
My problem was solved by reconfiguring my AVW Fritz!Box 7270 to 802.11 b+g only and limit the phones wifi frequency to 2,4ghz only. You can find that in advanced wifi configuration.
I'm lucky i only recognized this bug in my own wifi network and not others i don't have admin rights for...
eduroam works for me with PEAP/TTLS but I guess it's 802.11g
I'm on the 40002 rom, but worked also on the 31006
After receiving the 4.0.4 update yesterday, WiFi now works flawlessly.
Cheers,
chross
Hi there,
I got the same problem with my university network in hamburg. I updated the razor to android 4.0.4 (Stock-Rom: 81.5.40002.XT890.Retail.en.EU), also the phone is rooted but still not working. Our IT advices to use WPA2 Enterprise TTLS/PAP authenthication in combination with a t-com root certificate. Every time i safe these setting the wifi signal drops as told by previous posters and the connection fails. When i enter the settingspage again, all settings are reverted to default. This also happens, while trying to connect to eduroam
any further advices?
Thanks in advance!
I have no problems connecting to eduroam at Braunschweig and other citys. Maybe you can visit the IT Desk at your university?
jagwar1 said:
I have no problems connecting to eduroam at Braunschweig and other citys. Maybe you can visit the IT Desk at your university?
Click to expand...
Click to collapse
Yep, me and and a fellow student went there and told them about the problem. But they also gave up, after trying about an hour or so. It seems to be a general problem in the used android build, at least there are a lot of post reporting this at the google code repo -> code.google. com /p/android/issues/detail?id=15631 (sorry for that but I'm to new here to post links). I'll try the provided tips like changing the wpa_suplicant file tomorrow and report the results. Seems to be strange issue, if it works for you (and probably others), because a fellow student got the same Phone and has the same issues
Thought I'd just give an update as I have the same issue
Motorola knows about it, it's been reported to them before and said it'll be fixed with the next update.
Working smooth here with WPA2-Enterprise, PEAP and MSCHAPv2. Using it every day.
But I'm not using TTLS, you might want to disable that if you don't have a valid certificate for your mobile/user.
Also important, fill out the "anonymous user" field with your username. Depending on the RADIUS configuration of your IT this might be required.
[edit]
Just checked my mobile. I don't use a Phase 2 authentication, only EAP = PEAP, no certificates.
Got it working!
After 2 hours of searching the web and playing around, I got it working now, following this guide posted on google code repo:
Razr I (XT890), retail eu, running android 4.0.4 (stock), no root
after endless hours of trying i was able to connect to my university network a couple of minutes ago with the combination of two apps.
1. WiFi Connection Manager
Enter SSID manually
Security "802.1x EAP"
EAP Method "PEAP"
Phase 2 authentication "MSCHAPV2"
Identity "your identity"
Anonymous identity "your identity"
password "your password".
2. WiFi Advanced Configuration Editor
Check Hidden SSID
Key Management: unselect IEEE8021X, select WPA_EAP
AUTH Protocols: select LEAP
Enterprise configuration: make sure Identity and Anonymous Identity are set to your identity, Enter your password
check whether the settings are saved in WIFI Advanced Configuration Editor. If not switch of stock WiFi and repeat step 2 (!!!). Now it should work.
Turn WiFi on and connect to network (Stock WiFi; don't care about settings there, phase 2 authentification is still not saved)
After switching the device off and back on it did still work. Same when leaving and returning to WiFi area.
hopefully it will keep on working. i just tested the browser and play store. didn't discover any problems so far.
Click to expand...
Click to collapse
Connection is stable, but there seem to be some problems regarding to the speed. Whatever it's usable for stuff you do regularly @university.
Hope that helps others, thanks to klemens
hey.qb said:
Hope that helps others, thanks to klemens
Click to expand...
Click to collapse
Thank you for sharing, this made me so happy!
It's those two apps which made my connection possible.
My eduroam configuration is quite different, but the apps did the trick. I fiddled with advanced wifi config editor alone for hours without any result.
Now I just hammered the config into those two apps and what can I say - proxydroid reported a connection a few seconds later.
I dont't know what Moto's Problem with 802.1X is.
Defy latest stock rom - no connection. With CM -> no problem.
Milestone 2 with stock rom - no connection. With CM -> no Problem.
Rarz I no connection with stock wifi manager . . .
My fellow students with their samsung devices seem so have no problem at all. ^^
(even Win Mobile 6 works, thats a little bit depressing)
btw, speed is fine here. 16Mbit up&down is more than I need on a phone.
Greetings from Kiel.

Is it possible to preload wifi credentials onto a custom ROM?

So I'd like to get my chromecast working on the TV in our on-call room, but it seems impossible. I've tried spoofing the mac address using my Nexus 5 in order to get onto the network that uses a captive portal for logging in, and it got stuck on "connecting". I've tried using fqrouter, which has failed repeatedly for some reason (maybe problems with Lollipop?). I haven't figured out how to even begin trying to get the CC to connect to the WPA2 enterprise network. I unfortunately don't have a suitable wifi repeater on hand for trying out that approach and finally I'm not sure my cellphone's connectivity and monthly data allowance would be enough for the chromecast (I suspect not).
So what I'm wondering now is, is there any way to activate support for wpa2 enterprise and preload the credentials on a custom ROM?
If not, can you think of any other approach I haven't tried yet? :/
thanks in advance, any and all help appreciated
Alternatively, is it possible to send URL:s to the chromecast's built-in browser and maybe send javascript commands via those URL:s eg for filling in and submitting username and password?

Categories

Resources