I am able to connect to 802.1 networks via the nm-applet. I do not like doing this as I am running without a nm most of the time and I would hate to load up one just to connect to a wireless network.

When connecting to an 802.1 network I get the following error:

Error: Failed to add/activate new connection: (32) Failed to determine AP security information

I do not know how to work around this as nmcli does not seem to provide any means of specifying the network type.

  • are you getting this error message when you try to create a new connection profile ?
    – Rabin
    Jul 19, 2014 at 23:21
  • @Rabin This is a new connection. I was not trying to make a new profile, or understand what context you are using new connection profile in. I was simply trying to connect to it using nmcli d wifi connect eduroam .....
    – tensai
    Jul 22, 2014 at 18:36
  • I use a script which call nmcli like this, nmcli con up 'connection-uuid', but i must have this connection in my NetworkManager first.
    – Rabin
    Jul 22, 2014 at 20:02
  • Yes, this was my problem. If I have not connected to the network before, how do I do it. There are many situations where I cannot start up a user interface. I have connected to these type of networks before using wpa-supplicant and configuring the configuration files manually
    – tensai
    Jul 22, 2014 at 21:27
  • Like @tensai said, it might make sense to manually configure using nmcli con edit command.
    – feverDream
    Feb 25, 2016 at 0:54

4 Answers 4


You can create a WPA2 Enterprise connection using an nmcli command line like (substitute your own wifi device name for wlp3s0, and so forth):

nmcli connection add \
 type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
 wifi-sec.key-mgmt wpa-eap 802-1x.eap tls 802-1x.identity "USERNAME" \
 802-1x.ca-cert ~/ca.pem 802-1x.client-cert ~/cert.pem \
 802-1x.private-key-password "..." 802-1x.private-key ~/key.pem

It will then be listed under nmcli connection, and can be brought up using nmcli connection up MySSID.

Authenticating with a username and password

(This section was helpfully added by a contributor editing the post:)

Or if you use a username/password auth (likely via RADIUS) you can use the command below to add it (use the correct 802-1x.eap option for your network, the example of ttls as below doesn't require a certificate to be defined) and then use --ask the first time you go to connect to save the password into the connection file.

nmcli connection add \
 type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
 wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls \
 802-1x.phase2-auth mschapv2 802-1x.identity "USERNAME" 

If using the username/password option you should add --ask after nmcli the first time you bring it up to save the password without leaving it in your command history. It will give you an error message saying as much when you attempt to bring it up otherwise. You will probably get prompted about additional wireless settings when using --ask, you can type no for them unless you need to specify a static IP, in which case answer yes for that option and set the correct information, and in the future you shouldn't need to use --ask unless your password changes.

Exploring nmcli on your own

In general, the space of possible nmcli settings can be explored by adding the words asdf.asdf asdf to the end of the command line to produce an error message stating what words are possible substitutions for the first asdf. Choose one, and then you will get an error message listing the possible sub-settings for the second asdf. Choose one of those, and you will see the possible settings:

$ nmcli connection add ... asdf.asdf asdf
Error: invalid or not allowed setting 'asdf': 'asdf' not among [connection, 802-11-wireless (wifi), 802-11-wireless-security (wifi-sec), 802-1x, ipv4, ipv6].
$ nmcli connection add ... wifi-sec.asdf asdf
Error: invalid property 'asdf': 'asdf' not among [key-mgmt, wep-tx-keyidx, auth-alg, proto, pairwise, group, leap-username, wep-key0, wep-key1, wep-key2, wep-key3, wep-key-flags, wep-key-type, psk, psk-flags, leap-password, leap-password-flags].
$ nmcli connection add ... wifi-sec.proto asdf
Error: failed to modify wifi-sec.proto: 'asdf' not among [wpa, rsn].

By iterating through all of the sub-settings, I was able to piece together the successful command line shown above. The one surprise was that the password must precede the private key path — if you put the password later, it has no effect!

  • Good stuff, was able to connect after replacing my device found with nmcli d show | head and then using --ask for the password: nmcli con up --ask "MySSID"
    – kigiri
    Jul 17 at 11:01

nmcli Wifi

Get Wifi status

nmcli radio wifi

Turn wifi on or off

nmcli radio wifi <on|off>

List available access points(AP) to connect to

nmcli device wifi list

Refresh previous list

nmcli device wifi rescan

Create a new connection to an open AP

nmcli device wifi connect <SSID|BSSID>

Create a new connection to a password protected AP

nmcli device wifi connect <SSID|BSSID> password <password>

source: http://fedoraproject.org/wiki/Networking/CLI#Wifi

  • 2
    I know all these options :( None of them seem applicable for 802.1X networks though. Surely this is accounted for somehow since I can connect via the applet.
    – tensai
    Jul 23, 2014 at 18:36
  • @tensai, I'm having the same issue: "Error: Failed to add/activate new connection: (32) 802-11-wireless-security.psk: property is invalid"
    – tslater
    Feb 11, 2017 at 1:09
  • @tensai, what can you see in the output of journalctl ?
    – Rabin
    Feb 12, 2017 at 20:38
  • Nothing in this answer has any relevance at all to 802.1X. I'm hard-pressed to see how it's relevant to the question. Jan 13, 2020 at 18:22

NetworkManager can generate WPA2 Enterprise profiles with graphical front ends. nmcli and nmtui do not support this, but may use existing profiles.

More about connection to WPA2_Enterprise networks

  • nmcli does not allow complex passwords containing special characters; however, nmtui allows this and much more :) --Thank you @hurst
    – Achilles
    Sep 16, 2018 at 12:22

It seems that nmcli is unable connect to WPA2-enterprise networks. The networks have to either be manually configured or created via the various applets.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .