blog:aruba-mpsk-freeradius

This is an old revision of the document!


Using Aruba MPSK with FreeRADIUS

A few months ago Aruba introduced the MPSK authentication feature for their WiFi systems. With MPSK it is possible to have a PSK protected SSID but with a per device/MAC password. Unfortunately it is only officially supported to work with the Clearpass Policy Manager from Aruba. However, we could figure out how to use it with the FreeRADIUS Radius Server.

From the WebUI, create a new SSID with MPSK authentication. It is not possible to select an existing Radius server, just create a new dummy server. Now, edit the SSID profile and now change the dummy server to your (previously configured) FreeRADIUS server

When a client connects the controller will send a Radius request to the server. In the response you just have to include the VSA “Aruba-MPSK-Passphrase”. FreeRADIUS already includes the VSA with correct encoding and encryption. Here is an example, please note that “Tunnel-Password” is the clear text password for the requesting MAC.

Aruba-MPSK-Passphrase := “%{proxy-reply:Tunnel-Password}”

  • The controller seems to cache the password for an unknown period of time (seems to be a couple of hours)

If you have any feedback to this article, please let me know!

  • blog/aruba-mpsk-freeradius.1582991606.txt.gz
  • Last modified: 2020/02/29 16:53
  • by v0tti