Raspberry Pi WPA2-Enterprise WiFi Setup#
This guide provides instructions for connecting Raspberry Pi devices to WPA2-Enterprise WiFi networks (commonly found in institutional environments). This setup is required for devices like the picam, a1_cam, and other Raspberry Pi-based equipment in the AC Training Lab when operating on enterprise networks.
Consider running your devices in headless mode (e.g., Raspberry Pi OS Lite (bookworm)) in general, especially for any Raspberry Pi Zero 2W’s that we have, to reduce the resources consumed by the OS.
Some considerations:
Connecting to WPA2-Enterprise WiFi. After a lot of troubleshooting and debugging, I found a good way to get this working on bookworm:
Connecting to WPA2-Enterprise WiFi#
following based on ChatGPT prompt, username redacted
Connect to a WPA2-Enterprise network on a headless Raspberry Pi Zero 2W running OS Lite (bookworm). I have access to the terminal already. It’s on a WPA2-personal network at the moment, and I want to switch it to a WPA2-Enterprise network (specifically, University of Toronto wireless with SSID “UofT”) … How can I do this without exposing my password to the command line?
1. Verify the Current Network Status:
First, let’s check the current status of your wireless interface (wlan0) to understand its state.
ip addr show wlan0
iwgetid
This command will display the IP address and connection status of wlan0.
2. Install Necessary Packages:
Ensure that network-manager and its associated tools are installed, as they provide utilities like nmcli and nmtui for network configuration.
sudo apt update
sudo apt install network-manager
Optionally, you can run sudo apt upgrade to upgrade all packages.
3. Disable Conflicting Network Services: [OPTIONAL]
To prevent conflicts, optionally disable other network management services such as dhcpcd (this may not apply to bookworm, but may help with earlier versions like buster). If you get Failed to disable unit: Unit file dhcpcd.service does not exist. you can ignore this.
sudo systemctl disable dhcpcd
sudo systemctl stop dhcpcd
4. Enable and Start NetworkManager:
Activate NetworkManager to manage network connections.
sudo systemctl enable NetworkManager
sudo systemctl start NetworkManager
5. Configure the WPA2-Enterprise Connection Using nmtui:
The nmtui (NetworkManager Text User Interface) tool provides an interactive way to set up network connections.
sudo nmtui
Within the nmtui interface:
Select “Edit a connection”.
Choose “Add”, then “Wi-Fi”.
Set the SSID to “UofT”.
Under “Wi-Fi Security”, select “WPA & WPA2 Enterprise”.
For “Authentication”, choose “Protected EAP (PEAP)”.
Enter your UTORid (“***”) in the “Username” field.
Enter the domain (in UofT’s case,
radius.wireless.utoronto.caper their online instructions, NOTE:.utoronto.canot@utoronto.ca)Leave “Anonymous identity” blank unless specified otherwise by the university’s IT guidelines. If the interface requires you to enter something, try entering whatever you’d like (e.g.,
anonymous). Sometimes, it just needs a valueFor “CA Certificate”, if the university provides a specific certificate, specify its path.
Set “Inner authentication” to “MSCHAPv2”.
Enter your UTORid password in the “Password” field.
Note that users with sudo or root access can see the password again if they go digging. I suggest changing your university password to something unique and specific to it (e.g., memorable password generated via 1password). You could also do something like make sure only you have root access and create a non-admin account that others on your team can SSH into, but some consideration might be required when trying to get the device to autostart a script.
After configuring these settings, save and exit nmtui.
6. Connect to the “UofT” Network:
Attempt to establish the connection using nmcli.
sudo nmcli connection up UofT
If you are SSH’d into the device, it may close your connection. If all goes well, you should be able to connect after waiting a minute or so. Otherwise, if something catastrophic happens (i.e., it’s unable to connect at all), then you’ll need access to the device to manually follow these steps.
7. Verify the Connection:
Check if wlan0 has obtained an IP address and is connected to the “UofT” network.
ip addr show wlan0
iwgetid
You can also check (example output also shown):
sudo nmcli dev status
DEVICE TYPE STATE CONNECTION wlan0 wifi connected UofT
Alternatively, you can use sudo nmtui and “Activate Connection” to see which one is currently active (which will have a *); however, if you are SSH’d into your device over WiFi, you will need to have a keyboard and mouse directly connected to the device in order to switch it this way (since you have to manually “Deactivate” before you can activate the new one, at which point your SSH connection is already broken).
Additional Considerations:
CA Certificate: While some institutions require a CA certificate for secure connections, others do not. If the University of Toronto does not mandate a specific CA certificate, you can configure the connection without it. However, using a CA certificate enhances security by validating the server’s identity.
Consult University IT Support: For institution-specific configurations or requirements, reach out to the University of Toronto’s IT services or consult their support documentation.
By following these steps, you should be able to connect your Raspberry Pi Zero 2W to the “UofT” WPA2-Enterprise Wi-Fi network using your UTORid “***”.
Rebooting the device should still connect to the one most recently chosen.
WiFi Troubleshooting#
WLAN Country Setting#
If your WiFi connection is being blocked or you see soft-blocked WiFi when running rfkill list all, you may need to set the appropriate WLAN country code for your region:
sudo rfkill list all
If WiFi shows as “Soft blocked: yes”, you can temporarily unblock it with:
sudo rfkill unblock wifi
However, to prevent the WiFi from being blocked again after restarting NetworkManager, set the appropriate WLAN country code using raspi-config:
sudo raspi-config
Navigate to: Localisation Options > WLAN Country and select your country (e.g., US for United States, CA for Canada, DE for Germany).
Additional Resources#
Various resources during troubleshooting (see list in comment):
Integration with AC Training Lab Devices#
When setting up specific AC Training Lab devices that use Raspberry Pi hardware, refer to this documentation for the WiFi setup portion, then continue with the device-specific setup instructions:
Picam: Overhead camera system
A1 Mini Camera: Toolhead camera for 3D printer monitoring
Pioreactor: Automated bioreactor system
For these devices, complete the WPA2-Enterprise setup first, then proceed with the device-specific installation and configuration steps.