0

I'm wondering if the following is possible given the limitations/constraints of RADIUS, CoA, and fundamental limits of 802.11 authentication, etc.

I would like a wireless configuration with a single SSID that is protected (PSK). There would then be optional, secondary authentication using EAP-TLS using a RADIUS backend.

Users with only the PSK would drop into VLAN X. Users with PSK and certificates (EAP-TLS) would drop into VLAN Y.

A requirement would be that if the RADIUS server was unavailable, users would still be able to connect via PSK into VLAN X.

Fundamentally, this scheme can be implemented using two different SSIDs but I am wondering they can be combined.

Improve this question

1 Answer 1

Reset to default
1

That doesn't seem possible.

An IEEE 802.11 SSID beacon identifies that WAP as SAE capable - then PSK is used - or not - then 802.1X is used. It can't be both.

If you mean PSK first and then 802.1X on top, that could be possible - but not within the 802.11 standard. You'd need to create your own extensions, on the WAP and on the client side.

See IEEE 802.11-2020 clause 11.1.4 for details (free download after registration).

Improve this answer
1
  • I do mean always using PSK, and then optionally using 802.1X. But your second point answers the question, as it is not possible with the standard. Thank you.
    – user3814483
    Commented Oct 22, 2022 at 12:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.