Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Here details of my Wireless network

  1. hidden SSID (non-broadcast)
  2. The authentication protocol used is PEAP, which is a username and password protocol.
  3. The username and password are passed between the client and authentication server (RADIUS) over an SSL encrypted session.
  4. 3-tier CA environment.

    Root (offline), intermediate (offline), and 2 issuing CA certificates (online

    The actual SSL certificates on the authentication servers (RADIUS) will come from on of the 2 issuing CAs. That enables a trusted SSL session to be established to pass the username and password. But I haven't had the need to add those certificates to wpa_config.

  5. MS-CHAPv2 Support

My wpa_supplicant.conf

NOTE: this used to work for 6 months, but doesn't anymore since a couple of days ago.

/etc/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=1
update_config=1
fast_reauth=0

network={
  priority=1
  mode=0
  ssid="hidden-ssid"
  scan_ssid=1
  proto=RSN
  key_mgmt=WPA-EAP
  eap=PEAP
  identity="user"
  password="[FILTERED]"
}

When it worked I use to have this status:

[root@machine ~]# wpa_cli status
Selected interface 'wlan0'
bssid=00:48:00:12:0a:9d
ssid=hidden-ssid
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=COMPLETED     <==============
ip_address=10.75.9.32
Supplicant PAE state=AUTHENTICATED <===
suppPortStatus=Authorized
EAP state=SUCCESS
selectedMethod=25 (EAP-PEAP)
EAP TLS cipher=AES128-SHA
EAP-PEAPv0 Phase2 method=MSCHAPV2

But now, for yet an undiscovered reason, the authentication doesn't complete.

wpa_state goes : ... => ASSOCIATED => SCANNING ==> ASSOCIATING => ASSOCIATED => SCANNING => etc ...

 # wpa_cli status
 Selected interface 'wlan0'
 bssid=34:a8:4e:1f:ad:2d
 ssid=pmwproc
 id=0
 pairwise_cipher=CCMP
 group_cipher=TKIP
 key_mgmt=WPA2/IEEE 802.1X/EAP
 wpa_state=ASSOCIATED         <==== Associated with Access point but ....
 ip_address=0.0.0.0
 Supplicant PAE state=HELD    <==== PAE state is HELD instead of AUTHENTICATING or AUTHENTICATED
 suppPortStatus=Unauthorized
 EAP state=FAILURE            <==== Failure
 selectedMethod=25 (EAP-PEAP)
 EAP TLS cipher=(NONE)

MY QUESTION: What is the PAE state and why once ASSOCIATED does the PAE state is become HELD?

share|improve this question
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.