Palm Wi-Fi Profile Wizard Overview

Network administrators use the Palm® Wi-Fi Profile Wizard to create Wi-Fi® profiles and save them in a profile database. You may alternately create profiles by writing command scripts.
The profile specifies the security configuration of your corporate Wi-Fi network as it applies to 802.1X-based user authentication with the RADIUS server. Users (clients) in your network copy the profile(s) to their Palm T|X handheld for use when connecting to your Wi-Fi network.

See Also

Creating a Wi-Fi Profile Using the Wizard
Creating a Wi-Fi Profile Using a Command Script
Sample Script File


Creating a Wi-Fi® Profile Using the Wizard

1
Start the Palm® Wi-Fi Profile Wizard, and then click New.
2
Enter a Profile Name, for example, YourEnterpriseName WLAN or John at Palm. Spaces are permitted.

[*] NOTE This is the name that the Palm T|X handheld user sees in the profile pick list on the handheld.

3
Choose an Authentication Protocol for this profile from one of the following 802.1X-based authentication protocols.

• EAP-TLS (Extensible Authentication Protocol + Transport Layer Security)

• EAP-TTLS (Extensible Authentication Protocol + Tunneled TLS)

• EAP-PEAP (Extensible Authentication Protocol + Protected EAP)

• LEAP (Lightweight Extensible Authentication Protocol)

[!] IMPORTANT Your choice must match the settings that the network administrator used on the RADIUS server.

4
Choose a Tunneled Authentication Protocol.
If you selected EAP-TTLS or EAP-PEAP as the authentication protocol, select one of the following protocols for the authentication handshake:

• EAP-TTLS: The Palm T|X handheld supports PAP, CHAP, MSCHAP, MSCHAPv2, EAP-GTC, EAP-MD5-Challenge, and EAP-MSCHAPv2.

• EAP-PEAP : The Palm T|X handheld supports MSCHAPv2, GTC, and MD5-Challenge. This is true for PEAPv0 and PEAPv1.

[!] IMPORTANT Your choice must match the settings that the network administrator used on the RADIUS server.

[*] NOTE The tunneled authentication protocol field is inactive if the authentication protocol you selected is EAP-TLS or LEAP. For EAP-TLS, the client is authenticated by means of the CA and client certificate, so no tunnel is required. For LEAP, the client is authenticated by means of the username and password, so no tunnel is required.

5
Enter the Username and Password that the RADIUS server will use for authentication. These fields are unique for each network user.

[*] NOTE For EAP-TLS, only a username is required because a client certificate is used.

[*] NOTE If you include user-specific information in the profile, you must create a separate profile for every network user. If you leave these fields blank, users may fill in these values on their Palm T|X handhelds, if necessary.

6
Enter the Initial Identity if it's required by the selected authentication protocol.
Authentication protocols EAP-TTLS and EAP-PEAP create a tunnel for secure handshaking between the Palm T|X handhelds on the Wi-Fi network and the corporate RADIUS server. This field can be used to log in anonymously and establish the tunnel. The typical values for this field are anonymous or anonymous@<company_name>.com.
If the Initial Identity field is left blank but is required by the authentication protocol, the username is used for establishing the tunnel.
7
You may need to include certificates in this profile before saving it.

See Also

Supported Protocols
Specifying CA and Client Certificates
Viewing and Editing a Wi-Fi Profile

Tip
Later, when the user is configuring Palm T|X handheld to connect to the secure Wi-Fi® network, they will need to pick the profile created here. The profiles are identified by the name entered in step 2.


Creating a Wi-Fi Profile Using a Command Script

You can run the Palm® Wi-Fi Profile Wizard from the command line to either bring up the wizard or run a previously created scriptfile.txt to create the Wi-Fi® profile. Use the following command:
PalmWiFiProfileWizard [scriptfile.txt]

• If you don't specify scriptfile.txt, the Wi-Fi Profile Wizard opens in interactive mode, and you can create a Wi-Fi profile using the wizard.

• If you specify scriptfile.txt, that file is loaded and executed.

Script File Format

Script files may contain any number of lines. Each line may contain white space, a comment, or a command to execute. White space includes spaces, tabs, or just blank lines.
Comments begin with the pound sign (#). For example:
# This is a comment.
It is also valid to place a pound sign (#) and a comment at the end of a command. For example:
load test.pdb # Load the profile database
Specify commands as follows:
command_name [arg1] [arg2] [arg3] [...]
where command_name is the name of a valid script command, and [arg1] and so on are the arguments to the command. Text enclosed in quotation marks is treated as one argument, even if there are spaces. Thus, the following command would pass only one argument to the load command:
load "test file.pdb"

Script File Commands

Function | Command and Arguments
Start a new profile and reset to defaults. | new Necessary only if a single script is used to make multiple profile databases.
Load a profile from a profile database (PDB). | load <input profile filename.pdb>
Save the current profile to a profile database (PDB). | save <output profile filename.pdb>
Set profile name. | set_name <profile name> The profile name is 7-bit ASCII and may be a maximum of 27 characters.
Set authentication protocol. | set_auth <authentication protocol> Authentication protocol is EAP-MD5-Challenge, EAP-TLS, EAP-TTLS, EAP-PEAP, or EAP-LEAP.
Set inner authentication protocol. | set_inner_auth <inner authentication protocol> For EAP-TTLS authentication, the inner authentication protocol can be PAP, CHAP, MSCHAPv2, MSCHAPv1, EAP-MD5-Challenge, EAP-GTC, or EAP-MSCHAPv2. For EAP-PEAP authentication, the inner authentication protocol can be EAP-MSCHAPv2, EAP-GTC, or EAP-MD5-Challenge.
Set initial identity string. | set_initial_identity <initial identity> Initial identity can be a maximum of 63 characters.
Add a CA certificate to the profile. | add_ca_cert <input certificate file> Accepts DER and PEM and typically have the following file name extensions: .crt, .cer, .pem, and .der.
Remove a CA certificate from the profile. | remove_ca_cert <CA certificate index> Index is the zero-based index of the certificate.
Set the client certificate/private key file for this profile. | set_client_cert_pkey <input certificate file> Accepts PKCS12 and PEM and typically have the the following file name extensions: .pem, .p12, and .pfx. Required for TLS authentication, and optional for EAP-TTLS and EAP-PEAP.
Clear the client certificate/private key file selection from the profile. | clear_client_cert_pkey
Set the username to use for authentication. | set_username <username> The username can be a maximum of 63 characters.
Set the password to use for authentication. | set_password <password> The optional password can be a maximum of 63 characters.
Set the password to use for decrypting the client certificate/private key file. | set_pkpassword <pkpassword> The optional pkpassword can be a maximum of 63 characters.


Sample Script File

# Make default databases

# LEAP

set_name "LEAP Default"

set_auth LEAP

save "LEAP_Default.pdb"

# TTLS

new

set_name "TTLS Default"

set_auth EAP-TTLS

set_inner_auth PAP

add_ca_cert "CertPlus Class 1 Primary CA.cer"

add_ca_cert "CertPlus Class 2 Primary CA.cer"

add_ca_cert "CertPlus Class 3 Primary CA.cer"

add_ca_cert "DST (ABA.ECOM) CA.cer"

add_ca_cert "DST (Baltimore EZ) CA.cer"

add_ca_cert "Entrust.net Secure Server Certification Authority.cer"

add_ca_cert "First Data Digital Certificates Inc. Certification Authority.cer"

add_ca_cert "GTE CyberTrust Global Root.cer"

add_ca_cert "Microsoft Root Authority.cer"

add_ca_cert "Microsoft Root Certificate Authority.cer"

add_ca_cert "Thawte Server CA.cer"

add_ca_cert "Thawte Timestamping CA.cer"

add_ca_cert "UTN - DATACorp SGC.cer"

add_ca_cert "UTN - USERFirst-Network Applications.cer"

add_ca_cert "UTN - USERFirst-Object.cer"

add_ca_cert "ValiCert Class 1 Policy Validation Authority.cer"

add_ca_cert "ValiCert Class 2 Policy Validation Authority.cer"

add_ca_cert "ValiCert Class 3 Policy Validation Authority.cer"

add_ca_cert "VeriSign Class 1 Primary CA (4).cer"

add_ca_cert "VeriSign Class 1 Primary CA.cer"

add_ca_cert "VeriSign Class 1 Public Primary CA.cer"

add_ca_cert "VeriSign Class 2 Primary CA (1).cer"

add_ca_cert "VeriSign Class 2 Primary CA.cer"

add_ca_cert "VeriSign Class 2 Public Primary CA.cer"

add_ca_cert "VeriSign Class 3 Primary CA (2).cer"

add_ca_cert "VeriSign Class 3 Primary CA.cer"

add_ca_cert "VeriSign Class 3 Public Primary CA.cer"

add_ca_cert "VeriSign Class 4 Primary CA (3).cer"

add_ca_cert "VeriSign Class 4 Primary CA.cer"

add_ca_cert "VeriSign_RSA Secure Server CA.cer"

add_ca_cert "ViaCode Certification Authority.cer"

add_ca_cert "Xcert EZ by DST.cer"

save "TTLS_Default.pdb"

# PEAP

new

set_name "PEAP Default"

set_auth EAP-PEAP

set_inner_auth MSCHAPv2

add_ca_cert "CertPlus Class 1 Primary CA.cer"

add_ca_cert "CertPlus Class 2 Primary CA.cer"

add_ca_cert "CertPlus Class 3 Primary CA.cer"

add_ca_cert "DST (ABA.ECOM) CA.cer"

add_ca_cert "DST (Baltimore EZ) CA.cer"

add_ca_cert "Entrust.net Secure Server Certification Authority.cer"

add_ca_cert "First Data Digital Certificates Inc. Certification Authority.cer"

add_ca_cert "GTE CyberTrust Global Root.cer"

add_ca_cert "Microsoft Root Authority.cer"

add_ca_cert "Microsoft Root Certificate Authority.cer"

add_ca_cert "Thawte Server CA.cer"

add_ca_cert "Thawte Timestamping CA.cer"

add_ca_cert "UTN - DATACorp SGC.cer"

add_ca_cert "UTN - USERFirst-Network Applications.cer"

add_ca_cert "UTN - USERFirst-Object.cer"

add_ca_cert "ValiCert Class 1 Policy Validation Authority.cer"

add_ca_cert "ValiCert Class 2 Policy Validation Authority.cer"

add_ca_cert "ValiCert Class 3 Policy Validation Authority.cer"

add_ca_cert "VeriSign Class 1 Primary CA (4).cer"

add_ca_cert "VeriSign Class 1 Primary CA.cer"

add_ca_cert "VeriSign Class 1 Public Primary CA.cer"

add_ca_cert "VeriSign Class 2 Primary CA (1).cer"

add_ca_cert "VeriSign Class 2 Primary CA.cer"

add_ca_cert "VeriSign Class 2 Public Primary CA.cer"

add_ca_cert "VeriSign Class 3 Primary CA (2).cer"

add_ca_cert "VeriSign Class 3 Primary CA.cer"

add_ca_cert "VeriSign Class 3 Public Primary CA.cer"

add_ca_cert "VeriSign Class 4 Primary CA (3).cer"

add_ca_cert "VeriSign Class 4 Primary CA.cer"

add_ca_cert "VeriSign_RSA Secure Server CA.cer"

add_ca_cert "ViaCode Certification Authority.cer"

add_ca_cert "Xcert EZ by DST.cer"

save "PEAP_Default.pdb"


Specifying CA and Client Certificates

[!] IMPORTANT You must specify the appropriate CA and client certificates when creating a profile. This is the only method of installing certificates to connect to secure Wi-Fi networks on the Palm T|X handheld.

CA Certificates

CA (Certificate Authority) certificates are used to validate the identity of the network server when the Palm T|X handheld is attempting to connect to the Wi-Fi® network.

Client Certificates

Client certificates are used by TLS (Transport Layer Security) to identify the Palm T|X handheld to the server. If you plan to use client certificates, you must assign a unique client certificate to each network client Palm T|X handheld. This means you will need to create a Wi-Fi profile for each user.
The client certificate file may be encrypted. In that case, you can optionally specify a decryption password in the Private Key Password field. If the file is encrypted and you don't assign the private key password in the profile, the user will need to assign this password on the Palm T|X handheld.

[*] NOTE A client certificate is required for EAP-TLS and is optional for EAP-TTLS and EAP-PEAP. A client certificate is not used for LEAP.

Supported Certificate Formats

Client certificates/private key file formats are PKCS12 (.pfx and .p12) and PEM (.pem). For CA certificates, raw DER (.cer, .crt, .der) and PEM (.pem) are supported. PKCS7 (.p7b) is NOT supported. The client certificate/private key file must contain both a valid client certificate and a private key.

1

[!] Before You Begin This procedure instructs you to browse to the CA and client certificates that you want to bundle in this profile. Be sure you have access to the certificates before you begin.

In the wizard's list of certificates, specify the CA certificate(s) appropriate to the selected authentication protocol.

• Click Add to browse and select the appropriate CA certificate(s) to add to the profile. You can also drag and drop certificate files directly into the CA certificate list.

• Click Remove to remove the selected CA certificate(s) from the profile.

[*] NOTE You can include more than one CA certificate in a profile, and they can be from separate sources (certificate authorities).

[!] IMPORTANT You must include all the certificates necessary to verify your RADIUS server certificate on the Palm T|X handheld. This includes a root CA certificate and optionally some intermediate certificates. See the examples to understand which certificates must be included in the Wi-Fi profile.

2

[&] OPTIONAL Choose a client certificate for the Palm T|X handheld that will use this profile.

[!] IMPORTANT Every network user must have a unique client certificate to identify the user/Palm T|X handheld individually. Only one client certificate can be specified per profile, which means you must create a Wi-Fi profile for each network user if you use client certificates.

• Click Set to browse and select a client certificate to add to the profile. For more information, see Choosing Certificates for a Wi-Fi Profile.

• Click Clear to remove the selected client certificate from the profile.

3

[&] OPTIONAL If you chose a client certificate, you can enter a password in the Private Key Password field. If the client certificate/private key file is encrypted, this is the password that is necessary to decrypt the file.

[!] IMPORTANT If you do not specify a private key password and one is required, the user must assign it on the Palm T|X handheld. You'll need to inform the user of the password separately.

[!] IMPORTANT A client certificate/private key file is required for TLS authentication.

4
Click Save when you have finished. The profile is saved in a profile database file (in PDB format). You can save the profile using any file name you want. It does not need to match the profile name.

See Also

Creating a Wi-Fi Profile Using the Wizard
Creating a Wi-Fi Profile Using a Command Script
Viewing and Editing a Wi-Fi Profile
Choosing Certificates for a Wi-Fi Profile

Tip
You can also use the command line script interface of this wizard to generate multiple profiles, each with user specific data, such as client certificate or username/password.


Choosing Certificates for a Wi-Fi Profile

The following examples show the relationship between a root CA certificate, intermediate CA certificates, server certificates, and client certificates. This will help you specify the appropriate CA and client certificates in the Wi-Fi profile.

Example 1 - Multiple certificates derived from the same root CA certificate

Consider the following example certificates in your network environment:

• Root CA certificate: Root_Foo.pem

• Intermediate server certificate: Int_Server_Foo.pem

• Intermediate user certificate: Int_User_Foo.pem

• Network server certificate: MyNetwork.pem

• Client certificate for user John: john.pem

Consider that the hierarchy of the certificates in your network environment is:

In this example, the server certificate MyNetwork is derived from the intermediate server certificate Int_Server_Foo. The client certificate john.pem is derived from the intermediate user certificate Int_User_Foo. Both intermediate certificates are derived from the same root CA certificate, Root_Foo.
To determine which certificates to include in the Wi-Fi profile:

• For EAP-PEAP or EAP-TTLS authentication, the server certificate hierarchy is required. This implies that Int_Server_Foo and Root_Foo must be included in the Wi-Fi profile. Optionally, client certificates may be needed depending on your network configuration. If needed, john.pem and Int_User_Foo must also be included for the user John. Note that the client certificate is unique for each network user and hence different profiles will be needed, one for each network user.

• For EAP-TLS authentication, the server and client certificate hierarchy is required. This implies that Int_Server_Foo and Root_Foo must be included in the Wi-Fi profile. Also, client certificates are needed for EAP-TLS - john.pem and Int_User_Foo must be included for the user John. Note that the client certificate is unique for each network user and hence different profiles will be needed, one for each network user.

• For LEAP, no certificates are required.

Example 2: Certificates derived from different root CA certificates

Consider the following example certificates in your network environment:

• Root CA Certificates: Root_Foo_1.pem and Root_Foo_2.pem

• Network server certificate: MyNetwork.pem

• Client certificate for user John: john.pem

Consider that the hierarchy of the certificates in your network environment is:

In this example, the server certificate MyNetwork is derived from a root CA certificate Root_Foo_1. However, the client certificate, john.pem, is derived from another root CA certificate Root_Foo_2.
To determine which certificates to include in the Wi-fi profile:

• For EAP-PEAP or EAP-TTLS authentication, the server certificate hierarchy is required. This implies that Root_Foo_1 must be included in the Wi-Fi profile. Optionally, client certificates may be needed depending on your network configuration. If needed, john.pem and Root_Foo_2 must also be included for user John. Note that the client certificate is unique for each network user and hence different profiles will be needed, one for each network user.

• For EAP-TLS authentication, the server and client certificate hierarchy is required. This implies that Root_Foo_1 must be included in the Wi-Fi profile. Also, client certificates are needed for EAP-TLS - john.pem and Root_Foo_2 must be included for the user John. Note that the client certificate is unique for each network user and hence different profiles will be needed, one for each network user.

• For LEAP, no certificates are required.


Supported Protocols

This table describes, for each authentication method, the security requirements that need to be configured in the Wi-Fi® profile.

Authentication Protocol | Tunneled Authentication Protocol | CA Certificate | Client Certificate | Initial Identity
EAP-TLS | Not required | Required | Required | Not required
EAP-TTLS | Required | Required | Optional | Optional
EAP-PEAP | Required | Required | Optional | Optional
LEAP | Not required | Not required | Not required | Not required


Viewing and Editing a Wi-Fi® Profile

You can open an existing Wi-Fi® profile to view and edit the settings.

1 | Choose Open in the File menu, browse to select the profile you want to open, and then click Open.
2 | Modify the profile (see Creating a Wi-Fi Profile Using the Wizard), and then click Save. The profile is saved in a profile database (PDB) file.
3 | If you are using an existing profile to create a new one, be sure to assign a new Profile Name and also to click Save As. You can save the profile using any file name you want. It does not need to match the profile name.

See Also

Creating a Wi-Fi Profile Using the Wizard
Creating a Wi-Fi Profile Using a Command Script
Specifying CA and Client Certificates

Tip
Only one profile can be open at a time.

Tip
You can also use an existing profile to create a new profile.


Telling Your Users About Wi-Fi® Profiles

As the network administrator, you can send a message to your company's Palm® T|X handheld users to let them know how to use the Wi-Fi® profile. Your message might include the following steps. Details on all of these steps are in the Palm T|X Handheld User Guide.

1 | Copy the profile to your Palm T|X handheld.
2 | Be sure that the current date is set on your Palm T|X handheld.
3 | Scan for your enterprise AP or enter the SSID manually. If you scanned to find the AP, select it and tap Edit - Configure. Select Enterprise for Security type. Select a mode and encryption appropriate to your network.
4 | Select a Wi-Fi profile for network access. The name in the pick list on the Palm T|X handheld is the same profile name that the network administrator used when creating the profile database.
5 | Enter your user name, password, and private key password, if required (and not specified in the profile).
6 | Connect to your Wi-Fi network.


Copyright

© 2005 Palm, Inc. Palm, Palm OS, and the Palm logo are among the trademarks or registered trademarks owned by or licensed to Palm, Inc. Wi-Fi is a registered certification mark of the Wi-Fi Alliance. All other brand and product names are or may be trademarks of, and are used to identify products or services of, their respective owners.


Palm Wi-Fi Profile Wizard

Use the Palm® Wi-Fi Profile Wizard to create profiles for Palm® T|X handheld users in your Wi-Fi® network. After you save the profiles in a profile database file (in PDB format) with your corporate network's security configuration, they can be used to configure security settings on the Palm T|X handheld.

V. 1.3