Hello, I am have been looking at Alta Labs but have always been wondering if they are compatible with the Passpoint protocol so I could use Google Orion or if so does Google Orion work?
Thanks
@microbot Yes, they are! We are working on a KB article to explain how to configure it, but in the meantime, I can DM you an example power-user config that should work.
1 Like
@Alta-Jeff Please DM me too! Thanks.
I did message you privately, can you let me know if you don’t see it?
-Jeff
Can you also DM me the config @Alta-Jeff
Thanks!
Sure @benmott
I’ve written a guide on it, not sure what the rules on this form are for posting links. But if you dm me I can send it to you as well.
Don’t know how to DM here would you be able to send it too me?
@Alta-Jeff, since March 19th my Alta APs have not allowed any connections to Google Orion. Is there an issue with the Radsec proxy?
Can you look at logs from the AP? It’s also worth reaching out to Google directly, as I’m unaware of any issues on our end, but I know they were planning on enforcing a stricter certificate policy.
Having the same issue. March 19th stopped checking in with Google
Logs look like there is a cert issue: @Alta-Jeff any ideas?
May 2 00:23:40 OpenWrt daemon.warn radsecproxy[2746]: verify error: num=2:unable to get issuer certificate:depth=4:CN=Buttonwood Radsec CA,O=Buttonwood,C=US
May 2 00:23:40 OpenWrt daemon.warn radsecproxy[2746]: Issuer=CN=openroaming.org,OU=Openroaming,O=Cisco Systems, Inc.,L=San Jose,ST=California,C=US
May 2 00:23:40 OpenWrt daemon.err radsecproxy[2746]: tlsconnect: SSL connect to 216.239.32.91 failed: error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
May 2 00:23:40 OpenWrt daemon.err radsecproxy[2746]: tlsconnect: SSL connect to 216.239.32.91 (216.239.32.91 port 2083) failed
Google may have updated their CA certificates. Can you download their bundle and set it up again?
-Jeff
I updated the certificates from the Orion bundle and still have this error. I updated the bw.radsec…., OpenRoaming, cert, and key entries since it created a new set while generating. Are those all the Orion entries or are some yours custom certificates? There are a few other certificates in the config listed but I didn’t change those.
None of those certificates are related to our infrastructure at all - it is purely Google infrastructure (and it looks like they are leveraging openroaming, etc.)
You’ll want to make sure that you only include the certificates that come in their latest bundle, nothing old. Also make sure that they are included in the same order they would be included in an ASCII-sorted order (i.e. if the cert name is 0.pem, then it would go before a.pem, etc.)
1 Like
I did get this working again. You’ll have to enter your own certs and keys of course.
{
"radsec": {
"tls": {
"default": {
"cacerts": {
"0de90ce2.0":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"238d1594.0":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"572c865c.0":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"e9f4548c.0":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"bw.radsec.cacert.pem":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"openroaming.root.cacert.pem":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----"
},
"cert":
"-----BEGIN CERTIFICATE-----
-----END CERTIFICATE-----",
"key":
"-----BEGIN EC PRIVATE KEY-----
-----END EC PRIVATE KEY-----"
}
},
"realms": {
"*": {
"servers": [ "216.239.34.91" ],
"tls": "default"
}
}
},
"hostapd": "
hs20=1
disable_dgaf=1
hs20_oper_friendly_name=eng:Orion
interworking=1
access_network_type=2
internet=1
roaming_consortium=F4F5E8F5F4
anqp_3gpp_cell_net=310,410;310,280;310,150;313,100
radius_acct_interim_interval=300
venue_name=eng:XXXXXX
nas_identifier=XXXXXX
domain_name=orionwifi.com
"
}
Hi isaac, WayFi Wireless is another option that supports 250+ carriers worldwide including paid offload like Orion and they support the AP6’s.
2 Likes
This thread has been automatically closed due to inactivity. If you believe you have the same issue, please create a new post describing your issue. Feel free to link to this post for context if desired.