[mbil]

Hi forum,

I have now updated my phone (Rm-92, N80 (03)) to 4.0707.0.7.
Went to job and tried WiFi EAP-LEAP, and guess what ?

- IT WORKS !! whee

Finally the Nokia team did it ! A big CHEERS goes out loud !

I run hidden SSID, DHCP and Proxy server for web-cache.

Allthough it was not a complete joy, as the very first time i tried to connect, i got the "Nokia-WSOD" (White Screen Of Death)
and the phone restarted.


Also the EAP-PEAP now works !!
Se my other posts for the settings I use.
But its the same hidden-SSID, DHCP and Proxy server (non auth proxy)

In general I have noticed overall system performance to be ALOT faster, and responding quicker. Very nice.

I am a happy user a last ...

[biyahero]

---

10-Apr-200709:15 AM
mbil wrote:
Hi forum,

Also the EAP-PEAP now works !!
Se my other posts for the settings I use.
But its the same hidden-SSID, DHCP and Proxy server (non auth proxy)

In general I have noticed overall system performance to be ALOT faster, and responding quicker. Very nice.

I am a happy user a last ...

---

mbil,

I'm sorry I can't find your other posts... could you tell me what your settings are? Here is what I tried, and I continue to get a message:

WLAN
Unable to connect
802.1x authentication failed.

WLAN Security Mode: 802.1x
WLAN Security Settings:
WPA mode: EAP
EAP plug-in settings
1. EAP-SIM - was checked and I unchecked it
2. EAP-AKA - was checked and I unchecked it
3. EAP-PEAP - I checked this

I then chose Options; Configure for EAP-PEAP
User Certificate -(not defined)
CA Certificate -(GTE Cyber Trust Global Root)
User name in use -(From Certificate)
Username - I tried blank and I also tried my Windows
username
Realm in use - (From Certificate)
Realm - (Blank)
Allow PEAPv0 - Yes
Allow PEAPv1 - Yes
Allow PEAPv2 - No

I then went to the Windows XP computer on my network and chose:

Local Area Network; Properties; Authentication
Enable IEEE 802.1x authentication for this computer (Checked)
EAP Type: Protected EAP (EAP-PEAP)
Computer Protected EAP Properties
When connecting Validate Server Certificate (Checked)

Trusted Root Certificate Authorities
GTE Cyber Trust Global Root - I chose this only because it was one of the few entries that had only one choice and the Nokia display truncates the end of the selections so I couldn't be sure I was choosing the same one with the other multiple selection choices.

I then set the phone to use the same Trusted Root Cerificate Authority as the phone... GTE Cyber Trust Global Root.

Select Authentication Method
Secured Password (EAP - MSCHAP V 2)
- The only other choice was "Smart Card or other certificate"

Then I clicked the "Configure" button next to it and made sure it was checked the (only option) "Automatically use my Windows logon name and password (and domain if any)"

Also I checked at the bottom "Enable Fast Reconnect"

Still doesn't work.. get the same authentication failed message.

Any tips to get this to work would be greatly appreciated!

[devik_umac]

why I still can't use eap leap in my campus?? " no gateway reply", if it works, is that i need to set some ip or wt?

[biyahero]

---

10-Apr-200709:15 AM
mbil wrote:
Hi forum,

I have now updated my phone (Rm-92, N80 (03)) to 4.0707.0.7.
Went to job and tried WiFi EAP-LEAP, and guess what ?

- IT WORKS !! whee

[...]snipped.

Also the EAP-PEAP now works !!

Se my other posts for the settings I use.
[snipped]

I am a happy user a last ...

---

mbil,
I just searched for all posts by you back to last year and I really can't find any that lists your settings for EAP-PEAP.

Could you post them please. I still can't get it to work.

Best Regards,

Dave

[mbil]

/discussions/board/message?board.id=connectivity&message.id=6472&query.id=153958#M6472


Quote:

Ok, I re-tested the EAP-PEAP with the settings in this thread:

WLAN security mode: 802.1X
WLAN security settings:
WPA mode: EAP
EAP plug-in settings: EAP-PEAP (only one checked, top of the priority list)
EAP-PEAP->Options->Configure:
[General] tab
User Certificate: (not defined)
CA certificate: (Cisco ACS CA)
User name in use: From Certificate
User name: (Blank)
Realm in use: From Certificate
Realm: (Blank)
Allow PEAPv0: Yes
Allow PEAPv1: No
Allow PEAPv2: No
[EAP] tab
EAP-MSCHAPv2 (only one checked, top of priority list)
TKIP encryption: disabled (not displayed)
EAP-MSCHAPv2 ConfigurationUsername: (AD Domain name)\(Username)
Prompt password: No
Password: (domain password)
[Encryption] tab
(All algorithms are checked)


Remember to choose hidden in network status, if you have hidden SSID !

Also I use DHCP and a web-proxy.

You may wonder why there is notthing in username and realm, but this is since PEAP doesnt verify the certificate, hence you do not need any.
Allthough must of my other tests I did have user name and domain, but this failed ! Wierd.

A note: When I installed the ACS CA Certificate I shoose Internet=Yes and Cer-control online = No
(Find this under tools-security-Certificate control - choose the Cert and choose "trust settings"

Anyway the above settings works.
So the E60 works with LEAP and PEAP !!
great !

end qoute

[mbil]

devik_umac - I have replied to you in the Connectivity thread - please continue there.

[biyahero]

Hello mbil,

Quoting you:
Ok, I re-tested the EAP-PEAP with the settings in this thread:

WLAN security mode: 802.1X
WLAN security settings:
WPA mode: EAP
EAP plug-in settings: EAP-PEAP (only one checked, top of the priority list)
EAP-PEAP->Options->Configure:
[General] tab
User Certificate: (not defined)
[end qoute]

OK I made my settings like those above.

[Quote]
CA certificate: (Cisco ACS CA)
[end qoute]

Now this part is a problem.... As far as I can tell to buy this Cisco ACS software costs $ 9,541. So unless I am missing something, only a large enterprise could justify running this type of certificate, and I only have a four computer home network.

Also a Verisign certificate appears to cost $ 500+ so even that is not reasonable. Aren't there any free certificates? Or I thought in some of the articles I have read in the past few days about this subject I had seen that you really didn't need to use certificates for EAP-PEAK? Is that wrong?

[Quote]
User name in use: From Certificate
User name: (Blank)
Realm in use: From Certificate
Realm: (Blank)
Allow PEAPv0: Yes
Allow PEAPv1: No
Allow PEAPv2: No
[EAP] tab
EAP-MSCHAPv2 (only one checked, top of priority list)
TKIP encryption: disabled (not displayed)
[end quote]


I made my other settings as above.

[Quote]
EAP-MSCHAPv2 Configuration
Username: (AD Domain name)\(Username)
Prompt password: No
Password: (domain password)
[Encryption] tab
(All algorithms are checked)
[end qoute]

With respect to the settings above, another difference in my situation and yours is that I see you are using Active Directory, and I am not using it nor can I use it reasonably if I understand it correctly since I have no server that would always be running so if my computer is not running I think the other computers on my small network would have complications.

So for the Username I have no AD Domain Name to enter, so would you recommend the Workgroup/username or just Windows username that I use to log on the machine with?

I see that in the Authentication Properties of EAP-MSCHAPv2 on the desktop machine there is a box entitled "Automatically use my Windows logon and password when connecting (and domain if any). Presumably if you were going to have that checked (the default) you would want to enter that same password in the
"EAP-MSCHAPv2 Configuration" above, which is what I did.

I did check all algorithms on the encryption tab.

[Quote]
Remember to choose hidden in network status, if you have hidden SSID !

Also I use DHCP and a web-proxy.

You may wonder why there is notthing in username and realm, but this is since PEAP doesnt verify the certificate, hence you do not need any.
Allthough must of my other tests I did have user name and domain, but this failed ! Wierd.
[end qoute]

So if PEAP doesn't verify certificates, why do you even need any certificate?

[Quote]
A note: When I installed the ACS CA Certificate I shoose Internet=Yes and Cer-control online = No
(Find this under tools-security-Certificate control - choose the Cert and choose "trust settings"
[end qoute]

Here is another problem I got... When I go to Tools I have no Security or Security-Cerificate Control. Does this only appear perhaps if you have installed certificates?

How *do* you go about installing certificates?

Thanks for your continued help!!

Best Regards,
Dave

[alexbal]

Has established to itself a new firmware v 4.0707.0.7 on phone N80 after that have ceased to work USSD inquiries (*102#), there is no opportunity to check up balance on any operators of communication in Russia

[biyahero]

---

12-Apr-200707:02 AM
biyahero wrote:
Hello mbil,

You said:
A note: When I installed the ACS CA Certificate I shoose Internet=Yes and Cer-control online = No
(Find this under tools-security-Certificate control - choose the Cert and choose "trust settings"

Then I replied:
Here is another problem I got... When I go to Tools I have no Security or Security-Cerificate Control. Does this only appear perhaps if you have installed certificates?

How *do* you go about installing certificates?

---

I was wrong... I found the Tools-Settings-Security-Certificate Management setting place.... I was looking only under Tools for a Security choice.

Still, while there are a lot of Certificate Authorities it appears that they are all set by default to be "Yes" on the Internet and "Online Certificate Check". Also it is not clear in any documentation I have found what "Mark" or "Unmark" means in the options.... selected or disabled perhaps?

Also the phone as it is has no "Personal Certificates" .... do you need to get and install (by some secret process that Nokia hides from us) one of these?

If you don't need any "Personal Certificates" do you need to "Unmark" all the other Certificate Authorities certificates except the one you are going to use (if mark means select for example). If this is the case, do you need to make sure to use the same Certificate Authorities certificate both on the phone and the desktop network machine(s)?

[maznio]

I have had PEAP-MSCHAPv2 running since I got the phone half a year ago, updated my FW twice since then, right now I use the latest version -- 4.0707.0.7. My configuration is WPA-Enterprise. At first I didn't receive any auth-request messages on the RADIUS, turned out to be because the phone didn't recognize the server certificate (I am my own Certification Authority). I used GPRS to download the CA certificate (.crt file), the phone immediately recognized it and added it to the list of authorities. No problems since then, except for the fact that every FW upgrade wipes all CA certs and I have to download mine after that again.
Hope this helps you gyus.

[mbil]

just for the fun of it - could you please post your WPA settings of your N80 ?

[maznio]

Sure, there they are:

WLAN Security mode: WPA/WPA2

WLAN Security settings ->
WPA mode: EAP
TKIP Encryption: Allowed

EAP Plugin settings ->
EAP-PEAP (only proto enabled)

EAP-PEAP Configuration -> General tab
User certificate: Not defined
CA certificate: My CA's cert (downloaded via GPRS as described previously)
User name in use: User-configured
User name: my username
Realm in use: From certificate
Realm: (empty)
Allow PEAPv0: Yes
Allow PEAPv1: Yes
Allow PEAPv2: No

EAP-PEAP Configuration -> EAP tab
EAP-MSCHAPv2 (only proto enabled)

EAP-MSCHAPv2 Configuration ->
User name: my username
Prompt password: No
Password: my password

EAP-PEAP Configuration -> Cipher tab
Everything enabled, except for the last two:
RSA, RC4, MD5
RSA, RC4, SHA
(didn't touch anything here, it is like that by default).

[planetf1]

Just another vote... Same here. Couldn't get EAp-TLS working before, now with 0707 it does!