Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Here details of my Wireless network

  1. hidden SSID (non-broadcast)
  2. The authentication protocol used is PEAP, which is a username and password protocol.
  3. The username and password are passed between the client and authentication server (RADIUS) over an SSL encrypted session.
  4. 3-tier CA environment.

    Root (offline), intermediate (offline), and 2 issuing CA certificates (online

    The actual SSL certificates on the authentication servers (RADIUS) will come from on of the 2 issuing CAs. That enables a trusted SSL session to be established to pass the username and password. But I haven't had the need to add those certificates to wpa_config.

  5. MS-CHAPv2 Support

My wpa_supplicant.conf

NOTE: this used to work for 6 months, but doesn't anymore since a couple of days ago.

/etc/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=1
update_config=1
fast_reauth=0

network={
  priority=1
  mode=0
  ssid="hidden-ssid"
  scan_ssid=1
  proto=RSN
  key_mgmt=WPA-EAP
  eap=PEAP
  identity="user"
  password="[FILTERED]"
}

When it worked I use to have this status:

[root@machine ~]# wpa_cli status
Selected interface 'wlan0'
bssid=00:48:00:12:0a:9d
ssid=hidden-ssid
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=COMPLETED     <==============
ip_address=10.75.9.32
Supplicant PAE state=AUTHENTICATED <===
suppPortStatus=Authorized
EAP state=SUCCESS
selectedMethod=25 (EAP-PEAP)
EAP TLS cipher=AES128-SHA
EAP-PEAPv0 Phase2 method=MSCHAPV2

But now, for yet an undiscovered reason, the authentication doesn't complete.

wpa_state goes : ... => ASSOCIATED => SCANNING ==> ASSOCIATING => ASSOCIATED => SCANNING => etc ...

 # wpa_cli status
 Selected interface 'wlan0'
 bssid=34:a8:4e:1f:ad:2d
 ssid=pmwproc
 id=0
 pairwise_cipher=CCMP
 group_cipher=TKIP
 key_mgmt=WPA2/IEEE 802.1X/EAP
 wpa_state=ASSOCIATED         <==== Associated with Access point but ....
 ip_address=0.0.0.0
 Supplicant PAE state=HELD    <==== PAE state is HELD instead of AUTHENTICATING or AUTHENTICATED
 suppPortStatus=Unauthorized
 EAP state=FAILURE            <==== Failure
 selectedMethod=25 (EAP-PEAP)
 EAP TLS cipher=(NONE)

MY QUESTION: What is the PAE state and why once ASSOCIATED does the PAE state is become HELD?

share|improve this question

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.