Notes on wireless networks in the Kelvin Building

From Iain Sim's email

The old system of wireless network in the Kelvin building is being withdrawn and replaced with a much more sophisticated wireless mesh system from Ubiquiti. With this system it should be possible to roam anywhere (almost) within the building without losing connectivity.

At introduction it consists of two virtual wireless networks, KELVIN and GUPHYSICS. It is anticipated that these will be augmented and improved at a later date.

KELVIN is a replica of the old PAGlaWireless with which you are probably familiar. Operation is exactly the same and the advertised PIN codes are the also the same. It also has the same lack of security and relatively strict firewall restrictions. This has been done to provide some continuity, and as an easy access point for undergraduates and visitors. It is anticipated that eventually KELVIN will be replaced.

GUPHYSICS is a new service which is fully encrypted and devoid of any firewall restrictions. It is now the recommended wireless network for staff and research students. You authenticate against this network with your GUPHYSICS username and password, which may be saved on your laptop/phone/tablet if you wish to give a one-time configuration. It is the same username and password as used for the normal desktop login for most Windows users, the staff database, workload model, and gradschool. Almost everyone in the school has a GUPHYSICS account already. For those few who don't, one can easily be created by visiting room 238 and asking Ian Anthony or Iain Sim (For IGR, see Jamie Scott). Scroll down for configuration instruction for mac, linux and windows.

The GUPHYSICS wireless network is an encrypted link, protected by WPA2 security and authenticated by your Windows domain username and password. When connecting to it for the first time most clients will pick up at least some of the settings, but some fine tuning is often required. The general settings are:

• Wireless security is WPA2 Enterprise
• Authentication is PEAP
• If there is an “Anonymous identity” field, leave this blank
• We are using a self-signed certificate to secure the communication. Many clients will not accept this by default, so either there will be some setting to allow this (for example, you may have to uncheck a “Validate CA certificate” option), or some dialog may pop up when connecting giving you the chance to accept or reject the certificate.
• PEAP version is automatic
• Inner/secondary authentication is MSCHAPv2

These instructions are for Lion, other versions are similar.

As is often the way configuration under MacOS X is the easiest. Click on the wireless network icon on the menu bar and select GUPHYSICS.

Leave the mode at automatic and enter your GUPHYSICS username and password. Click on join.

Accept the certificate presented by the server. Just click on continue.

Because you are changing the certificate trust you must now enter your MacOS password. Click on update settings.

You should now be connected.

There are some clues at http://support.apple.com/kb/HT3326.

On 10.6, you have to add a step, at the end of the sequence:

Go to the Network Preference panel (either via System Preferences, or at the bottom of the wireless menu in the menu bar). Select the GUPHYSICS network, and click on 'Advanced…'. Select the 802.1X tab. In the list of 'Authentication' methods for the GUPHYSICS user profile, select PEAP and TTLS and unselect the other ones. Click OK, and then Apply.

Thanks to Norman Gray for figuring this out.

These instructions are for Ubuntu 10.04 there is much variation between distributions but the general idea is the same.

Click on the network icon on the toolbar and select GUPHYSICS.

• Wireless security is WPA & WPA2 Enterprise
• Authentication is PEAP
• Anonymous identity is blank
• CA certificate is none
• PEAP version is automatic
• Inner/secondary authentication is MSCHAPv2

Click on connect. Ignore the warning about a certificate authority.

You should now be connected.

Windows (these instructions are for Windows 7, but XP, Vista and the server versions are all essentially the same).

Be warned before you begin that this is a lot more work than the others, but at least you only have to do it once.

1. Click on the wireless network icon on the taskbar, but don't select GUPHYSICS. Instead click on “Open network and sharing centre”.
2. Click on “Manage wireless networks” at the top left.
3. Click “Add”. Then “Manually create a network profile”.
   • Network name is GUPHYSICS
   • Security type is WPA2 Enterprise
   • Encryption type is AES
   • Security Key is blank
4. Click next.
5. Click on “Change connection settings”
6. Select the “Security” tab
7. Click on “Settings”
8. Uncheck the box marked “validate server certificate”
9. Click on “Configure”
10. Uncheck the box marked “Automatically use my Windows logon …“ and click OK
11. Click on “Advanced settings”
12. Tick the box marked “Specify authentication mode”
13. Select “User authentication” from the drop down box
14. Click on “Save credentials”, enter your username and password for GUPHYSICS, click OK
15. Click OK, then close.

You should now be connected.