I am able to connect to 802.1 networks via the nm-applet. I do not like doing this as I am running without a nm most of the time and I would hate to load up one just to connect to a wireless network.

When connecting to an 802.1 network I get the following error:

Error: Failed to add/activate new connection: (32) Failed to determine AP security information

I do not know how to work around this as nmcli does not seem to provide any means of specifying the network type.

  • are you getting this error message when you try to create a new connection profile ? – Rabin Jul 19 '14 at 23:21
  • @Rabin This is a new connection. I was not trying to make a new profile, or understand what context you are using new connection profile in. I was simply trying to connect to it using nmcli d wifi connect eduroam ..... – tensai Jul 22 '14 at 18:36
  • I use a script which call nmcli like this, nmcli con up 'connection-uuid', but i must have this connection in my NetworkManager first. – Rabin Jul 22 '14 at 20:02
  • Yes, this was my problem. If I have not connected to the network before, how do I do it. There are many situations where I cannot start up a user interface. I have connected to these type of networks before using wpa-supplicant and configuring the configuration files manually – tensai Jul 22 '14 at 21:27
  • Like @tensai said, it might make sense to manually configure using nmcli con edit command. – feverDream Feb 25 '16 at 0:54

You can create a WPA2 Enterprise connection using an nmcli command line like (substitute your own wifi device name for wlp3s0, and so forth):

nmcli connection add \
 type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
 wifi-sec.key-mgmt wpa-eap 802-1x.eap tls 802-1x.identity "USERNAME" \
 802-1x.ca-cert ~/ca.pem 802-1x.client-cert ~/cert.pem \
 802-1x.private-key-password "..." 802-1x.private-key ~/key.pem

It will then be listed under nmcli connection, and can be brought up using nmcli connection up MySSID.

Authenticating with a username and password

(This section was helpfully added by a contributor editing the post:)

Or if you use a username/password auth (likely via RADIUS) you can use the command below to add it (use the correct 802-1x.eap option for your network, the example of ttls as below doesn't require a certificate to be defined) and then use --ask the first time you go to connect to save the password into the connection file.

nmcli connection add \
 type wifi con-name "MySSID" ifname wlp3s0 ssid "MySSID" -- \
 wifi-sec.key-mgmt wpa-eap 802-1x.eap ttls \
 802-1x.phase2-auth mschapv2 802-1x.identity "USERNAME" 

If using the username/password option you should add --ask after nmcli the first time you bring it up to save the password without leaving it in your command history. It will give you an error message saying as much when you attempt to bring it up otherwise. You will probably get prompted about additional wireless settings when using --ask, you can type no for them unless you need to specify a static IP, in which case answer yes for that option and set the correct information, and in the future you shouldn't need to use --ask unless your password changes.

Exploring nmcli on your own

In general, the space of possible nmcli settings can be explored by adding the words asdf.asdf asdf to the end of the command line to produce an error message stating what words are possible substitutions for the first asdf. Choose one, and then you will get an error message listing the possible sub-settings for the second asdf. Choose one of those, and you will see the possible settings:

$ nmcli connection add ... asdf.asdf asdf
Error: invalid or not allowed setting 'asdf': 'asdf' not among [connection, 802-11-wireless (wifi), 802-11-wireless-security (wifi-sec), 802-1x, ipv4, ipv6].
$ nmcli connection add ... wifi-sec.asdf asdf
Error: invalid property 'asdf': 'asdf' not among [key-mgmt, wep-tx-keyidx, auth-alg, proto, pairwise, group, leap-username, wep-key0, wep-key1, wep-key2, wep-key3, wep-key-flags, wep-key-type, psk, psk-flags, leap-password, leap-password-flags].
$ nmcli connection add ... wifi-sec.proto asdf
Error: failed to modify wifi-sec.proto: 'asdf' not among [wpa, rsn].

By iterating through all of the sub-settings, I was able to piece together the successful command line shown above. The one surprise was that the password must precede the private key path — if you put the password later, it has no effect!


nmcli Wifi

Get Wifi status

nmcli radio wifi

Turn wifi on or off

nmcli radio wifi <on|off>

List available access points(AP) to connect to

nmcli device wifi list

Refresh previous list

nmcli device wifi rescan

Create a new connection to an open AP

nmcli device wifi connect <SSID|BSSID>

Create a new connection to a password protected AP

nmcli device wifi connect <SSID|BSSID> password <password>

source: http://fedoraproject.org/wiki/Networking/CLI#Wifi

  • 1
    I know all these options :( None of them seem applicable for 802.1X networks though. Surely this is accounted for somehow since I can connect via the applet. – tensai Jul 23 '14 at 18:36
  • @tensai, I'm having the same issue: "Error: Failed to add/activate new connection: (32) 802-11-wireless-security.psk: property is invalid" – tslater Feb 11 '17 at 1:09
  • @tensai, what can you see in the output of journalctl ? – Rabin Feb 12 '17 at 20:38
  • Nothing in this answer has any relevance at all to 802.1X. I'm hard-pressed to see how it's relevant to the question. – Charles Duffy Jan 13 at 18:22

NetworkManager can generate WPA2 Enterprise profiles with graphical front ends. nmcli and nmtui do not support this, but may use existing profiles.

More about connection to WPA2_Enterprise networks

  • nmcli does not allow complex passwords containing special characters; however, nmtui allows this and much more :) --Thank you @hurst – Achilles Sep 16 '18 at 12:22

It seems that nmcli is unable connect to WPA2-enterprise networks. The networks have to either be manually configured or created via the various applets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.