Most of time it is sufficient to let the system choose an access point using the builtin heuristics. This is the default behaviour when you mark an interface up or otherwise configure an interface by listing it in /etc/rc.conf, e.g.:

If there are multiple access points and you want to select a specific one, you can select it by its SSID:

In an environment where there are multiple access points with the same SSID (often done to simplify roaming) it may be necessary to associate to one specific device. In this case you can also specify the BSSID of the access point (you can also leave off the SSID):

There are other ways to constrain the choice of an access point such as limiting the set of frequencies the system will scan on. This may be useful if you have a multi-band wireless card as scanning all the possible channels can be time-consuming. To limit operation to a specific band you can use the mode parameter; e.g.:

will force the card to operate in 802.11g which is defined only for 2.4GHz frequencies so any 5GHz channels will not be considered. Other ways to do this are the channel parameter, to lock operation to one specific frequency, and the chanlist parameter, to specify a list of channels for scanning. More information about these parameters can be found in the ifconfig(8) manual page.

Once you have selected an access point your station needs to authenticate before it can pass data. Authentication can happen in several ways. The most common scheme used is termed open authentication and allows any station to join the network and communicate. This is the authentication you should use for test purpose the first time you set up a wireless network. Other schemes require cryptographic handshakes be completed before data traffic can flow; either using pre-shared keys or secrets, or more complex schemes that involve backend services such as RADIUS. Most users will use open authentication which is the default setting. Next most common setup is WPA-PSK, also known as WPA Personal, which is described below.

Once you have selected an access point and set the authentication parameters, you will have to get an IP address to communicate. Most of time you will obtain your wireless IP address via DHCP. To achieve that, edit /etc/rc.conf and add DHCP to the configuration for your device as shown in various examples above:

At this point, you are ready to bring up the wireless interface:

Once the interface is running, use ifconfig to see the status of the interface ath0:

The status: associated means you are connected to the wireless network (to the dlinkap network in our case). The bssid 00:13:46:49:41:76 part is the MAC address of your access point; the authmode OPEN part informs you that the communication is not encrypted.

In the case you cannot obtain an IP address from a DHCP server, you can set a fixed IP address. Replace the DHCP keyword shown above with the address information. Be sure to retain any other parameters you have set up for selecting an access point:

WPA-PSK, also known as WPA-Personal, is based on a pre-shared key (PSK) generated from a given password and that will be used as the master key in the wireless network. This means every wireless user will share the same key. WPA-PSK is intended for small networks where the use of an authentication server is not possible or desired.

The first step is the configuration of the /etc/wpa_supplicant.conf file with the SSID and the pre-shared key of your network:

Then, in /etc/rc.conf, we indicate that the wireless device configuration will be done with WPA and the IP address will be obtained with DHCP:

Then we can bring up the interface:

Or you can try to configure it manually using the same /etc/wpa_supplicant.conf above, and run:

The next operation is the launch of the dhclient command to get the IP address from the DHCP server:

If DHCP is not possible or desired, you can set a static IP address after wpa_supplicant has authenticated the station:

When DHCP is not used, you also have to manually set the default gateway and the nameserver:

The second way to use WPA is with an 802.1X backend authentication server. In this case WPA is called WPA-Enterprise to differentiate it from the less secure WPA-Personal with its pre-shared key. Authentication in WPA-Enterprise is based on the Extensible Authentication Protocol (EAP).

EAP does not come with an encryption method. Instead, it was decided to embed EAP inside an encrypted tunnel. There are many EAP authentication methods, but EAP-TLS, EAP-TTLS, and EAP-PEAP are the most common.

EAP-TLS (EAP with Transport Layer Security) is a very well-supported authentication protocol in the wireless world since it was the first EAP method to be certified by the Wi-Fi alliance. EAP-TLS will require three certificates to run: the CA certificate (installed on all machines), the server certificate for your authentication server, and one client certificate for each wireless client. In this EAP method, both authentication server and wireless client authenticate each other in presenting their respective certificates, and they verify that these certificates were signed by your organization's certificate authority (CA).

As previously, the configuration is done via /etc/wpa_supplicant.conf:

network={ ssid="freebsdap" proto=RSN key_mgmt=WPA-EAP eap=TLS identity="loader" ca_cert="/etc/certs/cacert.pem" client_cert="/etc/certs/clientcert.pem" private_key="/etc/certs/clientkey.pem" private_key_passwd="freebsdmallclient" }

Then add the following lines to /etc/rc.conf:

The next step is to bring up the interface:

As previously shown, it is also possible to bring up the interface manually with both wpa_supplicant and ifconfig commands.

With EAP-TLS both the authentication server and the client need a certificate, with EAP-TTLS (EAP-Tunneled Transport Layer Security) a client certificate is optional. This method is close to what some secure web sites do , where the web server can create a secure SSL tunnel even if the visitors do not have client-side certificates. EAP-TTLS will use the encrypted TLS tunnel for safe transport of the authentication data.

The configuration is done via the /etc/wpa_supplicant.conf file:

network={ ssid="freebsdap" proto=RSN key_mgmt=WPA-EAP eap=TTLS identity="test" password="test" ca_cert="/etc/certs/cacert.pem" phase2="auth=MD5" }

You also have to add the following lines to /etc/rc.conf:

The next step is to bring up the interface:

PEAP (Protected EAP) has been designed as an alternative to EAP-TTLS, and is the most used EAP standard after EAP-TLS. In other words, if you have a network with mixed OSes, PEAP should be the most supported standard after EAP-TLS.

PEAP is similar to EAP-TTLS: it uses a server-side certificate to authenticate clients by creating an encrypted TLS tunnel between the client and the authentication server, which protects the ensuing exchange of authentication information. In terms of security, the difference between EAP-TTLS and PEAP is that PEAP authentication broadcasts the username in the clear, with only the password sent in the encrypted TLS tunnel. EAP-TTLS will use the TLS tunnel for both username and password.

We have to edit the /etc/wpa_supplicant.conf file and add the EAP-PEAP related settings:

network={ ssid="freebsdap" proto=RSN key_mgmt=WPA-EAP eap=PEAP identity="test" password="test" ca_cert="/etc/certs/cacert.pem" phase1="peaplabel=0" phase2="auth=MSCHAPV2" }

The following must be added to /etc/rc.conf:

Then we can bring up the interface: