LANforge WiFi Access Point Network with 802.11r

1. Go to the Port Manager tab, select the parent device such as wiphy0, click Modify, set a specific channel/frequency. Repeat for wiphy1.
2. Select wiphy0, click Create, fill out appropriate information and create a virtual access point. Repeat for wiphy1.
3. The new vap should appear in the Port-Mgr table. Double-click to modify. Configure SSID and select WPA2 but do not fill in the Key/Phrase:
4. Select the Advanced Configuration tab in the Port-Modify window and check the box Advanced/802.1x and fill in the RADIUS IP/Port/Secret. Here the RADIUS server will be another instance of hostapd configured on a bridge interface and accessible via localhost.
5. Select the Custom WiFi tab in the Port-Modify window to fill in the additional hostapd options to enable and configure 802.11r. These lines will be appended to the end of the LANforge generated hostapd configuration file located in /home/lanforge/wifi of the resource in use.
   
   
   vap1 00:0e:8e:7e:e2:71 - Your MAC will be different.

   wpa_key_mgmt=FT-EAP
   ft_over_ds=1
   nas_identifier=000e8e7ee271   #vap1 MAC without colon delimiters, yours will differ.
   mobility_domain=a1a1
   r0_key_lifetime=10000
   r1_key_holder=000e8e7ee271   #vap1 MAC without colon delimiters, yours will differ.
   reassociation_deadline=1000
   pmk_r1_push=1
   
   #r0kh is vap2 MAC address, vap2 nas identifier, AES key
   r0kh=00:0e:8e:cb:fc:48 000e8ecbfc48 000102030405060708090a0b0c0d0e0f
   
   #r1kh is vap2 MAC address, vap2 r1 key holder MAC, AES key
   r1kh=00:0e:8e:cb:fc:48 00:0e:8e:cb:fc:48 0f0e0d0c0b0a09080706050403020100
   

   full configuration file: hostapd_vap1.conf
   
   vap2 00:0e:8e:cb:fc:48 - Your MAC will be different.

   wpa_key_mgmt=FT-EAP
   ft_over_ds=1
   nas_identifier=000e8ecbfc48   #vap2 MAC without colon delimeters, yours will differ.
   mobility_domain=a1a1
   r0_key_lifetime=10000
   r1_key_holder=000e8ecbfc48   #vap2 MAC without colon delimeters, yours will differ.
   reassociation_deadline=1000
   pmk_r1_push=1
   
   #r0kh is vap1 MAC address, vap1 nas identifier, AES key
   r0kh=00:0e:8e:7e:e2:71 000e8e7ee271 0f0e0d0c0b0a09080706050403020100
   
   #r1kh is vap1 MAC address, vap1 r1 key holder MAC, AES key
   r1kh=00:0e:8e:7e:e2:71 00:0e:8e:7e:e2:71 000102030405060708090a0b0c0d0e0f
   

   full configuration file: hostapd_vap2.conf
   
   If you wanted to add FT-PSK capability, add the following to the hostapd configuration file:
   

   wpa_key_mgt=FT-EAP FT-PSK
   wpa_passphrase=1234567890
   

   
   In this example, we are configuring push mode key distribution where the master key holder, R0KH, derives the R1 key for all secondary key holders, R1KH, listed in the configuration file and sends it to them over the DS via bridge interfaces. The R0KH and R1KH entries must be configured for all virtual access points in the 802.11r network.
   
   For more information on hostapd 802.11r configuration, see:
   general hostapd configuration
   https://www.w1.fi/cgit/hostap/plain/hostapd/hostapd.conf
   how to enable wifi roaming
   https://blog.fem.tu-ilmenau.de/archives/1002-HowTo-enable-WiFi-roaming-with-hostapd-and-VLANs.html
   802.11r hostapd example
   ftp://ftp.raspberry-pi-geek.com/pub/listings/rasp-pi-geek.com/04/AccessPoint/Listing04.txt
6. Repeat above steps A-E for vap2 on wiphy1.

1. Go to the port manager tab, select Create, then select Bridge and enter Quantity 1 and a Bridge Name, then Apply to create the bridge.
2. Modify the new bridge device to add vap1. Type vap1 in the text entry box, then select Add Ports, then select Apply.
3. Select Sync to verify vap1 is a configured and current bridge member.
4. Go to Netsmith, right-click the bridge and select Modify to add DHCP service. Select the DHCP checkbox at the bottom, then fill in the DHCP Lease Time, DHCP DNS, DHCP Range Min, DHCP Range Max and DHCP Domain if needed, then select OK.
5. Go to Netsmith, right-click in a free area and select New Router and select OK. Then drag the bridge br0 into the virtual router and select Netsmith Apply.

For more information see Virtual Router with DHCP Cookbook (skip the wanlink portion)

1. Go to Netsmith, right-click the bridge and select Modify Port to add RADIUS service.
2. Select the RADIUS checkbox, then select OK.
3. Setup the following configuration files to start the RADIUS service. You will need to create these files, but the certificate files can be created by running the lf_kinstall script with the --do_radius option.
   
   /etc/hostapd.radius_clients

   0.0.0.0/0 lanforge 

   
   
   /etc/hostapd.eap_user

   "dot11r.user" PEAP
   "dot11r.user" MSCHAPV2 "!!dot11r123" [2]

   
   
   /home/lanforge/wifi/hostapd_br0.conf

   interface=br0
   driver=wired
   logger_syslog=-1
   logger_syslog_level=2
   logger_stdout=-1
   logger_stdout_level=2
   ctrl_interface=/var/run/hostapd
   ctrl_interface_group=0
   eapol_key_index_workaround=0
   eap_server=1
   eap_user_file=/etc/hostapd.eap_user
   server_id=ct523-3n-f20   #Your server_id will be different.
   radius_server_auth_port=1812
   radius_server_clients=/etc/hostapd.radius_clients
   
   ca_cert=/etc/raddb/certs/ca.pem
   server_cert=/etc/raddb/certs/server.pem
   private_key=/etc/raddb/certs/server.key
   private_key_passwd=lanforge
   

4. Verify that there are three hostapd processes running with the command:
   

   ps auxwww |grep hostapd

   which should show something similar to the following:

1. Go to Netsmith, right-click in a free area, select New Bridge, enter Quantity 1 and a Bridge Name, then select Apply. Sync Netsmith to view the new bridge.
2. Right-click the new bridge and select Modify Port to add vap2 as a bridge member.

1. In Netsmith, right-click in a free area and select New Connection to create an rdd pair. Select Skip for Port 1-B, WanLink and Port 2-B then select OK. Select Netsmith Apply after creating the new connection.
2. Right-click and select Modify Port br0, then add rddVR0 to br0, select Add Ports then select Apply. Your rddVRX numbering may differ depending on what other Netsmith objects are created.
3. Right-click and select Modify Port br1, then add rddVR1 to br1, select Add Ports then select Apply. Your rddVRX numbering may differ depending on what other Netsmith objects are created.
4. The final Netsmith display should show the two bridged virtual access points connected by a rdd pair

1. Client connected to vap1.
2. Client roams to vap2.
   
   
3. Client roams back to vap1.
   
   
4. FT messaging in hostapd logs.
5. A wireless capture of over-the-air packets shows the transition.
6. Output graph of the Mobility Plugin script of several roaming stations.