Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Configure Client Device for EAP-TTLS Authentication

To secure your network through EAP-TTLS authentication, follow these configuration steps on the client device.

HPE Mist Networking Access Assurance supports EAP-TTLS authentication only with PAP as the inner method. By default, most client devices such as Apple iOS/macOS and Windows attempt to use PEAP-MSCHAPv2 or EAP-TTLS/MSCHAPv2 when a user enters credentials at the SSID login prompt. These methods rely on password hashing (such as MSCHAPv2) and are not supported with modern cloud-based Identity Providers (IdPs). To enable successful onboarding, client devices must be explicitly configured to use EAP-TTLS with PAP. In production deployments, this configuration is typically enforced through Mobile Device Management (MDM) solutions. For validation or lab testing, however, the method can also be manually configured on the device by following the steps below

Prerequisites

  1. Download the HPE Mist Networking Org CA certificate:

    Client devices must trust the HPE Mist Networking Access Assurance server. The Org CA certificate must be included in the wireless profile you configure.

    1. In the management portal, go to Organization > Access > Certificates.. In the Certificate Authorities page, click View Mist Certificate to display the certificate details.
      Figure 1: Download CA Certificate View Certificate window displaying details of a signed certificate, including encoded text, common name, validity period, issuer, serial number, CRL distribution points, and subject alternative name. Background shows a list of certificates with download and close options.

    2. Click Download Certificate to download the certificate on your client device.

      Note: If you are using a custom server certificate, use the Root CA of the server certificate instead of the HPE Mist Networking Org CA.
  2. Configure the Identity Provider (IdP): From the left menu of the the HPE Mist management portal, select Organization > Access > Identity Providers > Add IDP and configure the required IdP details. For details, see Add Identity Providers.
    Figure 2: Configure the Identity Provider LDAP integration setup interface in HPE Mist Networking platform showing fields for Name, IDP Type, LDAP Type, Server Hosts, Domain Names, Default IDP option, Bind DN, Bind Password, Base DN, and sections for adding LDAPS certificates. Navigation menu on the left includes Monitor, Marvis, Clients, Access Points, Switches, WAN Edges, HPE Mist Networking Edges, Location, Analytics, Site, AB Testing, and Organization.
  3. Create an Auth Policy Rule: Under Organization> Access> Auth Policies, define an appropriate Auth Policy Rule that allows EAP-TTLS client devices to connect to the network. For details, see Configure Authentication Policy.
    Figure 3: Create an Auth Policy User interface for managing authentication policies in [MIST CSQA] ANIRUDH LAB, showing policy table with policy number, name, match criteria, actions, assigned policies, and hit count. Includes buttons for adding rules, creating labels, saving, and canceling changes. Dropdown menus for auth type and time filter are visible.

Configure Apple Device for EAP-TTLS Authentication

We've described the configuration using Apple macOS device.

For this task, create an EAP-TTLS network profile using a free Apple Configurator tool.

Create a profile on your Apple client device:

  1. On your macOS client, open your Apple Configurator tool, and click File > New Profile
    Figure 4: Wi-Fi Profile Configuration for Apple Client Apple Configurator on macOS with File menu open; New Profile option highlighted in red box for creating device configuration profiles.

    A new configuration profile document opens.

  2. On the left-navigation bar of the Apple Configurator page, click Certificates > Configure. Select and upload your Certificate that you downloaded (as mentioned in Prerequisites). For the client devices to trust the HPE Mist Networking Access Assurance Server, you must include it in the wireless profile.
    Figure 5: Upload HPE Mist Networking CA Certificate in Wi-Fi Profile Configuration Configuration interface with certificates option selected, marked as not configured, and a highlighted configure button to set up PKCS1 and PKCS12 certificates.
  3. From the left-navigation bar of the Apple Configurator tool, select Wi-Fi and click Configure.
    Figure 6: Wi-Fi Profile Configuration Configuration interface with menu options like General, Restrictions, Domains, and Wi-Fi. Wi-Fi is selected, showing instructions to configure wireless network settings and a red Configure button.

    Enter the following options for the Wi-Fi settings:

    • SSID—Your network's SSID. Ensure that you enter the correct SSID including capital letters.
    • Security Type—WPA2/WPA 3 Enterprise
    • Accepted EAP Types—TTLS and select Per-connection Password.
    • Inner Authentication—PAP
    Figure 7: Wi-Fi Profile Configuration Settings Wi-Fi profile configuration screen on macOS with SSID mist-aa, security type WPA2/WPA3 Enterprise, EAP type TTLS, per-connection password enabled, inner authentication set to PAP, and TLS versions specified.
  4. On the same page, under Enterprise Settings next to Protocols, click Trust. The page displays a list of uploaded certificates.

    Select the HPE Mist Networking CA certificate and enter auth.mist.com under Trusted Server Certificate Name. This step enables the client device to trust the HPE Mist Networking Access Assurance Server.

    Figure 8: Trust HPE Mist Networking CA Certificate in Wi-Fi Profile Configuration interface for setting up a wireless network with options for SSID, security type, enterprise settings, proxy setup, and QoS marking.
  5. Save the profile configuration.
    Figure 9: Save Wi-Fi Profile Configuration Apple Configurator application on macOS with File menu open and Save option highlighted. Wi-Fi payload is selected showing 1 Payload Configured. Other payloads are Not configured.
  6. To sign the profile, you need an Apple trusted certificate. This step is required for production use.

Now you can install the profile on to your macOS device and connect to SSID through EAP-TTLS.

For iOS and iPadOS

To test EAP-TTLS on an iPhone or iPad, you can export the configured Wi-Fi profiles from your macOS device and share them via AirDrop. Once received, install these profiles on the iOS device to connect using EAP-TTLS with PAP authentication.

  1. On your iOS device, open the Settings app and tap Profile Downloaded.
    Figure 10: Locate Profile Settings screen in dark mode showing Start Using iCloud and Finish Setting Up Your iPhone with red notification badges, Profile Downloaded highlighted in red, and other options like Airplane Mode, Wi-Fi, Bluetooth, Mobile Service, Battery, General, and Accessibility.
  2. Tap Install in the upper-right corner of the screen.
    Figure 11: Install Profile Installing configuration profile named Corp-NET with Wi-Fi certificate, marked Not Signed, options to Cancel, Install highlighted in orange, or Remove Downloaded Profile.

  3. Follow the on-screen instructions to complete the installation process.

  4. Enter username and password and click Join connect wireless network.

    Figure 12: Connect Wireless Network Wi-Fi login screen prompting for username and password to join Corp-NET network with Cancel and Join options, mode set to Automatic.

Configure Windows Device for EAP-TTLS Authentication

Use the following steps to configure a Windows device for EAP-TTLS authentication.

  1. Download the HPE Mist Networking Org CA certificate (as mentioned in Prerequisites) and import the Org CA Certificate on to your Windows device under Manage Computer Certificates > Trusted Root Certification Authorities.
    Figure 13: Trusted Root Certificates on Windows Device Microsoft Management Console interface showing the Certificates snap-in with a list of trusted root certification authorities, including columns for Issued To, Issued By, Expiration Date, and Intended Purposes.
  2. On your Windows device, go to Control Panel > Network and Sharing Center > Set up a new connection or network and select Manually connect to a wireless network and Click Next.
    Figure 14: Setup New Connection Network and Sharing Center in Windows Control Panel showing active network Airtel_Home 4 as public and Set Up a Connection wizard highlighting Manually connect to a wireless network option.
  3. In the Enter information for the wireless network you want to add, provide the following details:

    • Network name— Provide an SSID name.

    • Security type—Select the WPA2-Enterprise or WPA3-Enterprise option.

    Figure 15: Enter Information for Wireless Network Screenshot of Network and Sharing Center showing active network Airtel_Home 4 as public and a pop-up for manually connecting to a wireless network with fields for network name MGMT-SSID, WPA2-Enterprise security, AES encryption, and blank security key.

    When you click Next, a confirmation message appears stating that your SSID has been successfully added.

    Figure 16: Configure Wireless Network: Connection Settings Network and Sharing Center showing public network Airtel_Home 4 with options to set up a connection, troubleshoot problems, and a pop-up confirming MGMT-SSID added successfully.

    Click Change connection settings.

  4. Go to the Security tab, and under Choose a network authentication method, select Microsoft: EAP-TTLS and click Settings.
    Figure 17: Configure Wireless Network Properties Network and Sharing Center screenshot with MGMT-SSID Wireless Network Properties dialog showing WPA2-Enterprise security type, AES encryption, EAP-TTLS authentication, and a selected checkbox to remember credentials.

  5. In the TTLS Properties window, perform following actions:

    • Disable the Enable Identity Privacy option.

    • For the Connect to these servers, enter auth.mist.com

    • Under Trusted Root Certification Authorities, select the Mist Org CA certificate or Root CA of your custom RADIUS server certificate.

    • For Select a non-EAP method for authentication, select Unencrypted password (PAP)

      .
    Figure 18: Configure Wireless Network: TTLS Properties Network and Sharing Center showing settings for Airtel_Home 4 public network with TTLS Properties window open for authentication configuration options.

    Click OK.

  6. Back in the Security tab, click Advanced settings.

    • Check Specify authentication mode and select User Authentication option.
    • Click OK, then Close to complete your configuration.
    Figure 19: Configure Wireless Network: Advance Settings Windows Control Panel Network and Sharing Center showing active network Airtel_Home 4 as public. Pop-up window titled Advanced settings for wireless network with 802.1X authentication mode set to User authentication and single sign-on option.

Configure Android Device for EAP-TTLS Authentication

Use the following steps to configure an Android device for EAP-TTLS authentication. Navigation steps may vary slightly depending on the device model; the example provided here is based on a Google Pixel 9.

  1. Download the HPE Mist Networking Org CA Cert and saved to your device's storage.
  2. Open the Settings app on your Android device and navigate to Settings > Network and Internet> Internet > Network Preferences. Click Install Certificates.
    Figure 20: Install Certificate Network preferences screen showing options: Turn on Wi-Fi automatically, Notify for public networks, Allow WEP networks, Install certificates, and Wi-Fi Direct, with Wi-Fi certificate installed noted.

  3. From the internal storage upload the HPE Mist Networking Org CA certificate and enter the name of the certificate. If you are using a custom RADIUS server certificate, choose the Root CA corresponding to that server instead of the HPE Mist Networking Org CA.

    Figure 21: Enter Certificate Name Mobile device network settings showing options to turn on Wi-Fi automatically, notify for public networks, and allow WEP networks enabled. A pop-up dialog titled Name this certificate with a text field containing Mist-Org-CA-Cert and Cancel and OK buttons.

  4. Once the CA certificate is downloaded and installed, click on the SSID and configure the connection as follows:

    • EAP Method: TTLS
    • Phase 2 Authentication: PAP
    • CA Certificate: Select the Org CA Certificate
    • Domain: Enter auth.mist.com.
    • Credentials: Enter the Username and Password.
      Figure 22: Configure Wireless Network Wi-Fi network configuration screen for Corp-NET showing EAP Method TTLS, Phase 2 Authentication PAP, CA Certificate Mist-Org-CA-Cert, Minimum TLS Version TLS v1.0, Domain auth.mist.com, Identity jack@89mistilbs.org, and hidden Password with Cancel and Connect buttons.

      Click Connect to complete the configuration.

Configure Linux Device for EAP-TTLS Authentication

Use the following steps to configure EAP-TTLS authentication on a Linux (Ubuntu) device:

  1. Open the network settings and click on the SSID to be connected.
    Figure 23: Wireless Network Configuration Wi-Fi authentication window prompting for credentials to connect to Corp-NET network, with fields for security type, username, and password.
  2. Under Wi-Fi Security, choose WPA & WPA2 Enterprise.
  3. For Authentication, select Tunneled TLS (EAP-TTLS).
  4. Set the Domain field to: auth.mist.com
  5. For the CA certificate, select the HPE Mist Networking Org CA certificate that was previously downloaded. If you are using a custom RADIUS server certificate, choose the Root CA corresponding to that server instead of the HPE Mist Networking Org CA.
  6. Set Inner authentication (or Phase 2 Authentication) to PAP.
  7. Enter the Username and Password provided for authentication.
  8. Click Connect to complete the configuration.

Client Connection and Verification

  1. Connect your client device to the network with the username and password.
  2. From the left menu of the management portal, select Monitor > Service Levels > Insights. Under the Client Events section, view NAC client authentication events.
    Figure 24: NAC Client Authentication Events Network monitoring dashboard showing client authentication details and network activity. Includes client events, session info like MAC address, authentication type, access point, and data usage trends.

Related Documentation