[26719] in resnet
Re: Macs and 802..1x
daemon@ATHENA.MIT.EDU (Jason Healy)
Thu Sep 8 22:05:09 2011
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1084)
Content-Transfer-Encoding: 8bit
Message-ID: <AE25A952-A19A-4394-B0DA-3002024DB835@logn.net>
Date: Thu, 8 Sep 2011 21:50:30 -0400
Reply-To: Resnet Forum <RESNET-L@listserv.nd.edu>
From: Jason Healy <jhealy@logn.net>
To: RESNET-L@listserv.nd.edu
In-Reply-To: <47FE4CC0B92ADA478ECC286A11E973010472F2@SUEX10-mbx-03.ad.syr.edu>
We're all-mac and are having a few more problems than usual this year than in years past, mostly revolving around Lion and how it handles things. That said, most of the issues have a reasonable underlying cause (wrong password); it's just difficult to figure it out because Apple doesn't make it easy.
We have all students run a script to pre-seed their machine with the 802.1X certificate (we use PEAP on an Aruba controller). That prevents any issues with certificates, which used to be a major pain point a few years ago. Other than that, we rely on the auto-creation of the 802.1X profile when the machine prompts for authentication.
That said, if auth fails for any reason, OSX isn't great about telling you why (or even if) it happened. We have a one-page set of instructions for registration that explains how to wipe out 802.1X settings so users can try again. If you don't nuke them completely OSX will happily continue to use old, bad, credentials rather than prompting for new ones, which is very frustrating. This really bites you if you change their password in the directory; it doesn't update the credentials on the client and so auth fails until you clear them out.
We try to really focus on students knowing their password before they try to connect to the wireless network. With that procedure in place we haven't had too many issues. I'll find out for sure tomorrow; our biggest influx of new students happens in the afternoon.
I'm happy to share scripts, docs, or Aruba config info that we've crufted up over the years trying to get this all working...
Jason
--
Jason Healy | jhealy@logn.net | http://www.logn.net/
___________________________________________________
You are subscribed to the ResNet-L mailing list.
To subscribe, unsubscribe or search the archives,
go to http://LISTSERV.ND.EDU/archives/resnet-l.html
___________________________________________________
