wifi: Add doc for enterprise mode #21222

amar-nordic · 2025-03-28T14:16:26Z

Update the documentation in the wifi sample for
Enterprise-Mode security configuration

CLAassistant · 2025-03-28T14:16:35Z

All committers have signed the CLA.

NordicBuilder · 2025-03-28T14:18:35Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 17

Inputs:

Sources:

sdk-nrf: PR head: 6fb833d5ead65fbc363df2383eaf18fbc3467abc

more details

sdk-nrf:

PR head: 6fb833d5ead65fbc363df2383eaf18fbc3467abc
merge base: 6a99357fb00f3f468ad6396d58b324315718c315
target head (main): 6a99357fb00f3f468ad6396d58b324315718c315
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (2)

doc
│  ├── nrf
│  │  ├── app_dev
│  │  │  ├── device_guides
│  │  │  │  ├── nrf70
│  │  │  │  │  │ wifi_advanced_security_modes.rst
│  │  ├── releases_and_maturity
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst

Outputs:

Toolchain

Version:
Build docker image:

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain
◻️ Build twister
◻️ Integration tests

Disabled integration tests

- desktop52_verification
- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-boot
- test-fw-nrfconnect-chip
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_cloud
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_mosh
- test-fw-nrfconnect-nrf-iot_positioning
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-nrf_crypto
- test-fw-nrfconnect-proprietary_esb
- test-fw-nrfconnect-ps
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-tfm
- test-fw-nrfconnect-thread
- test-low-level
- test-sdk-audio
- test-sdk-dfu
- test-sdk-find-my
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

sachinthegreen

Should this document be located at ? :

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.html

richabp

The file needs to be added in the toctree- https://github.com/nrfconnect/sdk-nrf/blob/main/doc/nrf/protocols/wifi/station_mode/index.rst.

In addition, entry in the Changelog is required.

richabp · 2025-03-31T08:18:38Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+   :local:
+   :depth: 2
+
+Enterprise mode for Wi-Fi® is typically used in business environments or larger networks which require enhanced security, centralized management of users by utilizing Public Key Infrastructure (PKI).


Suggested change

Enterprise mode for Wi-Fi® is typically used in business environments or larger networks which require enhanced security, centralized management of users by utilizing Public Key Infrastructure (PKI).

Enterprise mode for Wi-Fi® is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).

richabp · 2025-03-31T08:21:52Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+
+Prerequisites
+=============
+


Suggested change

To use this mode, ensure that the following prerequisites are met:

richabp · 2025-03-31T08:28:42Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+Prerequisites
+=============
+
+* **RADIUS Server**: Along with self-signed local certificate(s) and private key for both Server-Side and Client-Side (for EAP-TLS)


Suggested change

* **RADIUS Server**: Along with self-signed local certificate(s) and private key for both Server-Side and Client-Side (for EAP-TLS)

* RADIUS Server in addition to self-signed local certificate(s) and private key for both server side and client side (for EAP-TLS).

richabp · 2025-03-31T08:31:59Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+=============
+
+* **RADIUS Server**: Along with self-signed local certificate(s) and private key for both Server-Side and Client-Side (for EAP-TLS)
+* **Wi-Fi® Access Point**: Which supports Enterprise Mode.


Suggested change

* **Wi-Fi® Access Point**: Which supports Enterprise Mode.

* Wi-Fi® Access Point (AP) that supports Enterprise mode.

richabp · 2025-03-31T08:50:06Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+
+* **RADIUS Server**: Along with self-signed local certificate(s) and private key for both Server-Side and Client-Side (for EAP-TLS)
+* **Wi-Fi® Access Point**: Which supports Enterprise Mode.
+* **nRF70 Series device** : With certificates for Enterprise Mode available at zephyr/samples/net/wifi/test_certs.


Suggested change

* **nRF70 Series device** : With certificates for Enterprise Mode available at zephyr/samples/net/wifi/test_certs.

* nRF70 Series device with certificates for Enterprise mode available at :file:`zephyr/samples/net/wifi/test_certs` folder.

richabp · 2025-03-31T10:31:45Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+Configure an Access Point with Authentication method as WPA2-Enterprise
+
+Server IP Address - IP of the RADIUS (Hostapd) Server
+
+Server Port - 1812
+
+Connection Secret - whatever
+
+PMF - Capable
+
+Apply the Configurations


Please check if the edits are correct. Suggesting to write the full term for PMF.

Suggested change

Configure an Access Point with Authentication method as WPA2-Enterprise

Server IP Address - IP of the RADIUS (Hostapd) Server

Server Port - 1812

Connection Secret - whatever

PMF - Capable

Apply the Configurations

Configure an access point with WPA2-Enterprise authentication method using the following parameters:

* Server IP address - IP address of the RADIUS (hostapd) server

* Server port - 1812

* Connection secret - whatever

* PMF - Capable

richabp · 2025-03-31T10:33:53Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+Build the nRF70 series DK for shell sample with Enterprise Mode
+=================================================================


Suggested change

Build the nRF70 series DK for shell sample with Enterprise Mode

=================================================================

Build the nRF70 Series DK for shell sample with Enterprise mode

=================================================================

richabp · 2025-03-31T10:41:29Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+Verify that the Client-Side Certificates required for EAP-TLS are available
+
+.. code-block:: bash
+
+    ls -l zephyr/samples/net/wifi/test_certs
+
+    cd nrf/samples/wifi/shell
+
+    west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y
+
+    west flash


Suggested change

Verify that the Client-Side Certificates required for EAP-TLS are available

.. code-block:: bash

ls -l zephyr/samples/net/wifi/test_certs

cd nrf/samples/wifi/shell

west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y

west flash

To build the nRF70 Series DK for the :ref:`wifi_shell_sample` sample with Enterprise mode, complete the following steps:

1. Verify that the client-side certificates required for EAP-TLS are available by using the following commands:

.. code-block:: bash

ls -l zephyr/samples/net/wifi/test_certs

cd nrf/samples/wifi/shell

west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y

west flash

richabp · 2025-03-31T10:52:07Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+To connect to WPA3-Enterprise AP
+---------------------------------
+
+.. code-block:: console
+
+    wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2
+
+example:
+
+.. code-block:: console
+
+    wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2
+


Suggested change

To connect to WPA3-Enterprise AP

---------------------------------

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2

example:

.. code-block:: console

wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2

#. Connect to the WPA3-Enterprise AP by using the following commands:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2

Example:

.. code-block:: console

wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2

richabp · 2025-03-31T10:58:10Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+To connect the DK to WPA2-Enterprise AP
+---------------------------------------
+
+.. code-block:: console
+
+    wifi connect -s <SSID> -k 7 -a anon -K whatever
+
+example:
+
+.. code-block:: console
+
+    wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever


Suggested change

To connect the DK to WPA2-Enterprise AP

---------------------------------------

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever

example:

.. code-block:: console

wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever

#. Connect the DK to the WPA2-Enterprise AP by using the following command:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever

Example:

.. code-block:: console

wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever

github-actions · 2025-04-01T08:22:13Z

You can find the documentation preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsdoc.z6.web.core.windows.net/PR-21222/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.html
https://ncsdoc.z6.web.core.windows.net/PR-21222/nrf/releases_and_maturity/releases/release-notes-changelog.html

richabp

Please add a changelog entry.

richabp · 2025-04-01T10:08:11Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+Enterprise mode testing using hostapd
+======================================
+
+Enterprise mode for Wi-Fi® is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).


We add the trademark only at the first occurrence.

Suggested change

Enterprise mode for Wi-Fi® is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).

Enterprise mode for Wi-Fi is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).

richabp · 2025-04-01T10:33:52Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+To use this mode, ensure that the following prerequisites are met:
+
+* RADIUS Server in addition to self-signed local certificate(s) and private key for both server-side and client-side (for EAP-TLS).
+
+* Wi-Fi® Access Point (AP) that supports Enterprise mode.
+
+* nRF70 Series device with certificates for Enterprise mode available at :file:`zephyr/samples/net/wifi/test_certs` folder.
+


Suggested change

To use this mode, ensure that the following prerequisites are met:

* RADIUS Server in addition to self-signed local certificate(s) and private key for both server-side and client-side (for EAP-TLS).

* Wi-Fi® Access Point (AP) that supports Enterprise mode.

* nRF70 Series device with certificates for Enterprise mode available at :file:`zephyr/samples/net/wifi/test_certs` folder.

To use this mode, ensure that the following prerequisites are met:

* RADIUS server in addition to self-signed local certificate(s) and private key for both server-side and client-side (for EAP-TLS).

* Wi-Fi Access Point (AP) that supports Enterprise mode.

* nRF70 Series device with certificates for Enterprise mode available in the :file:`zephyr/samples/net/wifi/test_certs` folder.

richabp · 2025-04-01T10:37:35Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+RADIUS server configuration
+---------------------------
+
+Hostapd is an open-source user space software that provides an integrated RADIUS server, which can be used to simplify the setup for Enterprise mode. Therefore, in the following example, hostapd is used as a RADIUS server (authentication server) to verify Enterprise mode functionality with the nRF7002 DK, along with commercial or test access points as the Authenticator.


Suggested change

Hostapd is an open-source user space software that provides an integrated RADIUS server, which can be used to simplify the setup for Enterprise mode. Therefore, in the following example, hostapd is used as a RADIUS server (authentication server) to verify Enterprise mode functionality with the nRF7002 DK, along with commercial or test access points as the Authenticator.

Hostapd is an open-source user space software that provides an integrated RADIUS server, which can be used to simplify the setup for Enterprise mode.

Therefore, in the following example, hostapd is used as a RADIUS server (authentication server) to verify Enterprise mode functionality with the nRF7002 DK, along with commercial or test access points as the authenticator.

richabp · 2025-04-01T11:08:59Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+#. Hostapd installation
+
+    To install hostapd, use the following commands:
+
+.. code-block:: console
+
+     git clone git://w1.fi/hostap.git
+
+     cd hostap/hostapd
+
+     cp defconfig .config
+
+#. Edit the :file:`.config` file for hostapd to use it as a RADIUS server by using the following commands:
+
+   .. code-block:: console
+
+      Comment (by adding #) the following configurations
+      #CONFIG_DRIVER_HOSTAP=y
+      #CONFIG_DRIVER_NL80211=y
+      #CONFIG_LIBNL32=y
+
+      Enable the following configurations (by removing # from the front)
+      CONFIG_DRIVER_NONE=y
+      CONFIG_RADIUS_SERVER=y
+      CONFIG_EAP_PSK=y
+      CONFIG_EAP_PWD=y
+      CONFIG_EAP_GPSK_SHA256=y
+      CONFIG_EAP_FAST=y
+
+      Add the following configurations
+      CONFIG_PEERKEY=y
+      CONFIG_IEEE80211W=y
+
+      Verify required EAP Types are enabled
+      "CONFIG_EAP=y"
+      "CONFIG_EAP_TLS=y"
+      "CONFIG_EAP_PEAP=y"
+      "CONFIG_EAP_TTLS=y"


Suggested change

#. Hostapd installation

To install hostapd, use the following commands:

.. code-block:: console

git clone git://w1.fi/hostap.git

cd hostap/hostapd

cp defconfig .config

#. Edit the :file:`.config` file for hostapd to use it as a RADIUS server by using the following commands:

.. code-block:: console

Comment (by adding #) the following configurations

#CONFIG_DRIVER_HOSTAP=y

#CONFIG_DRIVER_NL80211=y

#CONFIG_LIBNL32=y

Enable the following configurations (by removing # from the front)

CONFIG_DRIVER_NONE=y

CONFIG_RADIUS_SERVER=y

CONFIG_EAP_PSK=y

CONFIG_EAP_PWD=y

CONFIG_EAP_GPSK_SHA256=y

CONFIG_EAP_FAST=y

Add the following configurations

CONFIG_PEERKEY=y

CONFIG_IEEE80211W=y

Verify required EAP Types are enabled

"CONFIG_EAP=y"

"CONFIG_EAP_TLS=y"

"CONFIG_EAP_PEAP=y"

"CONFIG_EAP_TTLS=y"

Hostapd installation

--------------------

To install hostapd, complete the following steps:

1. Install hostapd by using the following commands:

.. code-block:: console

git clone git://w1.fi/hostap.git

cd hostap/hostapd

cp defconfig .config

#. Edit the :file:`.config` file for hostapd to use it as a RADIUS server by using the following commands:

.. code-block:: console

Comment (by adding #) the following configurations

#CONFIG_DRIVER_HOSTAP=y

#CONFIG_DRIVER_NL80211=y

#CONFIG_LIBNL32=y

Enable the following configurations (by removing # from the front)

CONFIG_DRIVER_NONE=y

CONFIG_RADIUS_SERVER=y

CONFIG_EAP_PSK=y

CONFIG_EAP_PWD=y

CONFIG_EAP_GPSK_SHA256=y

CONFIG_EAP_FAST=y

Add the following configurations

CONFIG_PEERKEY=y

CONFIG_IEEE80211W=y

Verify required EAP Types are enabled

"CONFIG_EAP=y"

"CONFIG_EAP_TLS=y"

"CONFIG_EAP_PEAP=y"

"CONFIG_EAP_TTLS=y"

richabp · 2025-04-01T11:14:46Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+#. Build the hostapd executable
+
+    .. code-block:: console
+
+        make clean ; make
+
+#. Copy the certificates for EAP-TLS to the hostapd folder by using the following commands:
+
+   .. code-block:: bash
+
+      cp zephyr/samples/net/wifi/test_certs/*  hostap/hostapd/
+
+      touch hostapd.eap_user_tls
+
+      vim hostapd.eap_user_tls
+
+      $ cat hostapd.eap_user_tls
+      # Phase 1 users
+      *       TLS
+
+      touch tls.conf
+
+      vim tls.conf


Suggested change

#. Build the hostapd executable

.. code-block:: console

make clean ; make

#. Copy the certificates for EAP-TLS to the hostapd folder by using the following commands:

.. code-block:: bash

cp zephyr/samples/net/wifi/test_certs/* hostap/hostapd/

touch hostapd.eap_user_tls

vim hostapd.eap_user_tls

$ cat hostapd.eap_user_tls

# Phase 1 users

* TLS

touch tls.conf

vim tls.conf

Build the hostapd executable

----------------------------

To build the hostapd executable, complete the following steps:

1. Build the hostapd executable by using the following commands:

.. code-block:: console

make clean ; make

#. Copy the certificates for EAP-TLS to the hostapd folder by using the following commands:

.. code-block:: bash

cp zephyr/samples/net/wifi/test_certs/* hostap/hostapd/

touch hostapd.eap_user_tls

vim hostapd.eap_user_tls

$ cat hostapd.eap_user_tls

# Phase 1 users

* TLS

touch tls.conf

vim tls.conf

richabp · 2025-04-01T11:16:45Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+    Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (Authenticator) through Ethernet.
+
+.. code-block:: bash
+
+    ./hostapd -i eno1 tls.conf
+
+    or
+
+    To enable debug messages and Key data
+    ./hostapd -i eno1 tls.conf -ddK
+


Do we need to add # before "To enable debug messages and Key data" to comment out?

Suggested change

Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (Authenticator) through Ethernet.

.. code-block:: bash

./hostapd -i eno1 tls.conf

or

To enable debug messages and Key data

./hostapd -i eno1 tls.conf -ddK

Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (authenticator) through Ethernet.

.. code-block:: bash

./hostapd -i eno1 tls.conf

or

To enable debug messages and Key data

./hostapd -i eno1 tls.conf -ddK

richabp · 2025-04-01T11:19:30Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+Wi-Fi® access point configuration
+----------------------------------


Suggested change

Wi-Fi® access point configuration

----------------------------------

Wi-Fi access point configuration

---------------------------------

richabp · 2025-04-01T11:21:56Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+* Server IP address - IP address of the RADIUS (hostapd) server
+
+* Server port - 1812
+
+* Connection secret - whatever
+
+* PMF - Capable
+
+Apply the configurations.


Suggesting to write the full term for PMF.
I dont think "Apply the configurations." is required.

Suggested change

* Server IP address - IP address of the RADIUS (hostapd) server

* Server port - 1812

* Connection secret - whatever

* PMF - Capable

Apply the configurations.

* Server IP address - IP address of the RADIUS (hostapd) server

* Server port - 1812

* Connection secret - whatever

* PMF - Capable

richabp · 2025-04-01T11:22:37Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+
+Apply the configurations.
+
+Build the nRF70 Series DK for shell sample with Enterprise mode


Suggested change

Build the nRF70 Series DK for shell sample with Enterprise mode

Build the nRF70 Series DK for Shell sample with Enterprise mode

richabp · 2025-04-01T11:26:46Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+#. Verify that the client-side certificates required for EAP-TLS are available by using the following commands:
+
+   .. code-block:: bash
+
+      ls -l zephyr/samples/net/wifi/test_certs
+
+      cd nrf/samples/wifi/shell
+
+      west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y
+
+      west flash
+
+
+#. Connect to the WPA3-Enterprise AP by using the following commands:
+
+    .. code-block:: console
+
+        wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2
+
+    Example:
+
+    .. code-block:: console
+
+        wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2
+
+
+#. Connect the DK to the WPA2-Enterprise AP by using the following command:
+
+    .. code-block:: console
+
+        wifi connect -s <SSID> -k 7 -a anon -K whatever
+
+    Example:
+
+    .. code-block:: console
+
+    wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever
+


Suggested change

#. Verify that the client-side certificates required for EAP-TLS are available by using the following commands:

.. code-block:: bash

ls -l zephyr/samples/net/wifi/test_certs

cd nrf/samples/wifi/shell

west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y

west flash

#. Connect to the WPA3-Enterprise AP by using the following commands:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2

Example:

.. code-block:: console

wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2

#. Connect the DK to the WPA2-Enterprise AP by using the following command:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever

Example:

.. code-block:: console

wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever

1. Verify that the client-side certificates required for EAP-TLS are available by using the following commands:

.. code-block:: bash

ls -l zephyr/samples/net/wifi/test_certs

cd nrf/samples/wifi/shell

west build -p -b nrf7002dk/nrf5340/cpuapp -- -DEXTRA_CONF_FILE=overlay-enterprise.conf -DCONFIG_WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG=y -DCONFIG_LOG_MODE_IMMEDIATE=y

west flash

#. Connect to the WPA3-Enterprise AP by using the following commands:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever -S 2 -w 2

Example:

.. code-block:: console

wifi connect -s WPA3-ENT_ZEPHYR_5 -k 7 -a anon -K whatever -S 2 -w 2

#. Connect the DK to the WPA2-Enterprise AP by using the following command:

.. code-block:: console

wifi connect -s <SSID> -k 7 -a anon -K whatever

Example:

.. code-block:: console

wifi connect -s WPA2-ENT_ZEPHYR_2 -k 7 -a anon -K whatever

richabp · 2025-04-01T18:59:52Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

@@ -65,6 +65,189 @@ You can use any AAA server for testing purposes, such as FreeRADIUS or hostapd.

    The certificates are for testing purposes only and should not be used for production.

+Enterprise mode testing on linux using hostapd


Suggested change

Enterprise mode testing on linux using hostapd

.. _ug_nrf70_wifi_enterprise_mode:

Enterprise mode testing on linux using hostapd

richabp · 2025-04-01T19:44:23Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

 * The :ref:`ug_wifi_regulatory_certification` documentation is now moved under :ref:`ug_wifi` protocol page.
+* Added a new section for Enterprise mode testing using hostapd to :ref:`ug_nrf70_wifi_advanced_security_modes` page


Suggested change

* The :ref:`ug_wifi_regulatory_certification` documentation is now moved under :ref:`ug_wifi` protocol page.

* Added a new section for Enterprise mode testing using hostapd to :ref:`ug_nrf70_wifi_advanced_security_modes` page

* Added a new section :ref:`ug_nrf70_wifi_enterprise_mode` in the :ref:`ug_nrf70_wifi_advanced_security_modes` page.

* The :ref:`ug_wifi_regulatory_certification` documentation is now moved under :ref:`ug_wifi` protocol page.

richabp · 2025-04-01T19:54:48Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+1. Hostapd installation
+
+    To install hostapd, use the following commands:
+
+.. code-block:: console
+
+       git clone git://w1.fi/hostap.git
+
+       cd hostap/hostapd
+
+       cp defconfig .config


Suggested change

1. Hostapd installation

To install hostapd, use the following commands:

.. code-block:: console

git clone git://w1.fi/hostap.git

cd hostap/hostapd

cp defconfig .config

Hostapd installation

--------------------

To install hostapd, complete the following steps:

1. Install hostapd by using the following commands:

.. code-block:: console

git clone git://w1.fi/hostap.git

cd hostap/hostapd

cp defconfig .config

richabp · 2025-04-01T19:59:57Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+1. Build the hostapd  executable by using the following commands:
+
+    .. code-block:: console
+
+        make clean ; make


Suggested change

1. Build the hostapd executable by using the following commands:

.. code-block:: console

make clean ; make

1. Build the hostapd executable by using the following commands:

.. code-block:: console

make clean ; make

richabp · 2025-04-01T20:02:40Z

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

+Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (authenticator) through Ethernet.
+
+   .. code-block:: bash
+
+        ./hostapd -i eno1 tls.conf
+
+        # To enable debug messages and Key data
+        ./hostapd -i eno1 tls.conf -ddK
+


Suggested change

Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (authenticator) through Ethernet.

.. code-block:: bash

./hostapd -i eno1 tls.conf

# To enable debug messages and Key data

./hostapd -i eno1 tls.conf -ddK

Run hostapd by using the following commands, assuming that **eno1** is the laptop interface connected to the AP (Authenticator) through Ethernet.

.. code-block:: bash

./hostapd -i eno1 tls.conf

#To enable debug messages and Key data

./hostapd -i eno1 tls.conf -ddK

doc/nrf/app_dev/device_guides/nrf70/wifi_advanced_security_modes.rst

Update the documentation for the wifi for Enterprise-Mode security configuration Signed-off-by: Amit Arora <amit.arora@nordicsemi.no>

bama-nordic · 2025-03-30T04:01:00Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+
+Enterprise mode
+################
+


Add the below:

.. contents::
:local:
:depth: 2

bama-nordic · 2025-03-30T04:05:06Z

doc/nrf/protocols/wifi/station_mode/enterprise_mode.rst

+PMF - Capable
+
+Apply the Configurations
+


Please add a pic here of the AP configuration for reference.

amar-nordic requested review from bama-nordic, krish2718, rado17, sachinthegreen, prsi98 and krga2022 March 28, 2025 14:16

amar-nordic requested a review from a team as a code owner March 28, 2025 14:16

github-actions bot added doc-required changelog-entry-required labels Mar 28, 2025

sachinthegreen reviewed Mar 28, 2025

View reviewed changes

amar-nordic force-pushed the enterprise_mode_doc branch 8 times, most recently from 44020f8 to 25979ff Compare March 28, 2025 15:18

krga2022 requested a review from richabp March 28, 2025 17:34

krish2718 changed the title ~~samples: wifi: Add doc for enterprise mode~~ wifi: Add doc for enterprise mode Mar 29, 2025

amar-nordic force-pushed the enterprise_mode_doc branch from 25979ff to ce8fa45 Compare March 31, 2025 07:40

richabp requested changes Mar 31, 2025

View reviewed changes

amar-nordic force-pushed the enterprise_mode_doc branch from ce8fa45 to b47f8a6 Compare April 1, 2025 08:02

amar-nordic force-pushed the enterprise_mode_doc branch from b47f8a6 to c3de48b Compare April 1, 2025 08:45

amar-nordic requested review from sachinthegreen and richabp April 1, 2025 08:49

amar-nordic force-pushed the enterprise_mode_doc branch from c3de48b to a28097d Compare April 1, 2025 09:50

richabp requested changes Apr 1, 2025

View reviewed changes

amar-nordic force-pushed the enterprise_mode_doc branch from a28097d to 1836855 Compare April 1, 2025 14:09

amar-nordic requested a review from a team as a code owner April 1, 2025 14:09

github-actions bot removed the changelog-entry-required label Apr 1, 2025

amar-nordic force-pushed the enterprise_mode_doc branch 2 times, most recently from 9aaf3b4 to a0d217a Compare April 1, 2025 14:26

bama-nordic added this to the 3.0.0 milestone Apr 1, 2025

richabp requested changes Apr 1, 2025

View reviewed changes

amar-nordic force-pushed the enterprise_mode_doc branch from a0d217a to d84f64b Compare April 2, 2025 06:22

amar-nordic requested a review from richabp April 2, 2025 07:08

amar-nordic force-pushed the enterprise_mode_doc branch from d84f64b to a2f6552 Compare April 2, 2025 09:26

wifi: Update the doc for enterprise mode

Loading
Loading status checks…

6fb833d

Update the documentation for the wifi for Enterprise-Mode security configuration Signed-off-by: Amit Arora <amit.arora@nordicsemi.no>

amar-nordic force-pushed the enterprise_mode_doc branch from a2f6552 to 6fb833d Compare April 2, 2025 09:59

richabp approved these changes Apr 2, 2025

View reviewed changes

bama-nordic approved these changes Apr 2, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

wifi: Add doc for enterprise mode #21222

wifi: Add doc for enterprise mode #21222

amar-nordic commented Mar 28, 2025

CLAassistant commented Mar 28, 2025 •

edited

Loading

NordicBuilder commented Mar 28, 2025 •

edited

Loading

sachinthegreen left a comment

richabp left a comment

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

richabp Mar 31, 2025

github-actions bot commented Apr 1, 2025 •

edited

Loading

richabp left a comment

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

richabp Apr 1, 2025

bama-nordic Mar 30, 2025

bama-nordic Mar 30, 2025

	Enterprise mode for Wi-Fi® is typically used in business environments or larger networks which require enhanced security, centralized management of users by utilizing Public Key Infrastructure (PKI).
	Enterprise mode for Wi-Fi® is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).



	To use this mode, ensure that the following prerequisites are met:

	* RADIUS Server: Along with self-signed local certificate(s) and private key for both Server-Side and Client-Side (for EAP-TLS)
	* RADIUS Server in addition to self-signed local certificate(s) and private key for both server side and client side (for EAP-TLS).

	* Wi-Fi® Access Point: Which supports Enterprise Mode.
	* Wi-Fi® Access Point (AP) that supports Enterprise mode.

	* nRF70 Series device : With certificates for Enterprise Mode available at zephyr/samples/net/wifi/test_certs.
	* nRF70 Series device with certificates for Enterprise mode available at :file:`zephyr/samples/net/wifi/test_certs` folder.

		Build the nRF70 series DK for shell sample with Enterprise Mode
		=================================================================

	Enterprise mode for Wi-Fi® is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).
	Enterprise mode for Wi-Fi is used in business environments or larger networks, which require enhanced security and centralized management of users by utilizing Public Key Infrastructure (PKI).

	Hostapd is an open-source user space software that provides an integrated RADIUS server, which can be used to simplify the setup for Enterprise mode. Therefore, in the following example, hostapd is used as a RADIUS server (authentication server) to verify Enterprise mode functionality with the nRF7002 DK, along with commercial or test access points as the Authenticator.
	Hostapd is an open-source user space software that provides an integrated RADIUS server, which can be used to simplify the setup for Enterprise mode.
	Therefore, in the following example, hostapd is used as a RADIUS server (authentication server) to verify Enterprise mode functionality with the nRF7002 DK, along with commercial or test access points as the authenticator.

		Wi-Fi® access point configuration
		----------------------------------


		Apply the configurations.

		Build the nRF70 Series DK for shell sample with Enterprise mode


		Prerequisites
		=============

		@@ -65,6 +65,189 @@ You can use any AAA server for testing purposes, such as FreeRADIUS or hostapd.

		The certificates are for testing purposes only and should not be used for production.

		Enterprise mode testing on linux using hostapd

		* The :ref:`ug_wifi_regulatory_certification` documentation is now moved under :ref:`ug_wifi` protocol page.
		* Added a new section for Enterprise mode testing using hostapd to :ref:`ug_nrf70_wifi_advanced_security_modes` page

wifi: Add doc for enterprise mode #21222

Are you sure you want to change the base?

wifi: Add doc for enterprise mode #21222

Conversation

amar-nordic commented Mar 28, 2025

CLAassistant commented Mar 28, 2025 • edited Loading

NordicBuilder commented Mar 28, 2025 • edited Loading

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

sachinthegreen left a comment

Choose a reason for hiding this comment

richabp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Apr 1, 2025 • edited Loading

richabp left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

CLAassistant commented Mar 28, 2025 •

edited

Loading

NordicBuilder commented Mar 28, 2025 •

edited

Loading

github-actions bot commented Apr 1, 2025 •

edited

Loading