Forum Discussion

twhall's avatar
twhall
Expert Protege
2 years ago
Solved

Meta Quest Pro WiFi setup fail on university network

We've purchased a bunch of new Meta Quest Pros for our university XR lab.  We cannot connect them to the university's WiFi network at all -- cannot get through the initial device setup.  In the WiFi settings, the Quest Pro does not seem to retain the CA Certificate selection [Use system certificates] nor the Domain name.  It indicates that it has saved the network settings, but fails to connect.  When I go back to the settings, all of the other settings appear to be retained: EAP method [PEAP], Phase 2 authentication [MSCHAPV2], Identity [correct], Anonymous identity [blank], Password [(unchanged) -- I can only guess whether it has been retained; I have retyped it many times].  But the CA certificate reverts to [Please select] and after selecting [Use system certificates] the Domain has reverted to [blank] again.

These things are bricks if we can't get past this.

We have many other WiFi devices running on our network -- notebook computers, phones, ...  it is not a problem with WiFi signal strength or stability.

  • Hey guys, I might find a weird workaround suddenly. Quest3 with v59

    1) Make sure quest does not automatically connect to any Wi-Fi, eg. forget all saved WiFi or disable "auto-connect";

    2) You need a open wifi that needs sign-in; 

    alternative might work: use a phone to set up a open wifi ðŸ¤”

    3) Connect to the open wifi, then in this Wi-Fi setting, disable the "auto-connect", and disconnect it. 

    4) Quest will push some notifications claiming that connection lost and tell you to sign-in. In the main menu, there is a ringbell icon - "Notifications" next to "Quick Settings", open it and click the notification that tells you to sign-in the open network.

    5) Quest will show a "SECRET" wifi menu hidden by Meta ðŸ˜…😅, I think it is the old version of wifi setting menu. 
    In this menu, you can choose the school WiFi and all other staff like "Domain". And the "connect" is clickable in my case😅

    Maybe it is a bug of the new Wi-Fi setting menu, please try and see if it works.

    MetaStoreHelp Please fix this ASAP

  • After nearly 11 months, we finally got the attention of competent people at Meta to look at the issue and provide a workaround.  The instructions Meta provided have some specifics to our secure campus network (after I provided them with campus IT URLs for their reference), so you'll need to adapt these to your own campus situation:

    [BLOCKQUOTE]

    I received an update from our Engineering team. Please see their response below;
    We see two possible root causes based on the logs:
    • The University's certificate cannot be verified with the system certificates of the device.
    • The domain is incorrect and should be "[xxx.yyy.zzz].edu" instead of "[zzz].edu" (less likely than the above.) Fortunately, the university IT admin page offers the certificate that devices can store to verify with. Can we ask the customer to try out the following steps?
    • Go to https://documentation.its.[zzz].edu/[long-URL-for-wifi-manually-configuring-wpa2-enterprise-devices] using their headset's browser after having a connection with their phone's hotspot or other available Wi-Fi network.
    • Download the "2038 USERTrust RSA Certification Authority root certificate" by following that link and clicking "Download Certificate: PEM" on the left column.
    • Try connecting to the enterprise network.
    • Instead of "Use system certificate", select "Install certificate".
    • The file browser will appear and you can find the downloaded certificate.
    • Install it as a "Wi-Fi certificate" type.
    • Give a name like "wifi".
    • At first installation, the Wi-Fi settings might prematurely close the Wi-Fi settings window. If so, try connecting from the Wi-Fi settings again.
    • Choose PEAP and MSCHAPv2.
    • At the certificate selection dropdown menu, you will see the certificate with the name that you gave. Select it.
    • Put in the domain, identity and password as before.
    • See if it succeeds. If it fails,
    • Forget the network.
    • Reconnect by following the same steps as above except for using "[xxx.yyy.zzz].edu" for the domain instead of "[zzz].edu" If that also fails, try the above two domain values but with the "2024 InCommon RSA Server CA intermediate certificate".
    • The link in the university's IT page leads to a txt file displayed on the browser directly. So you won't be able to download to the headset using that link.
    • You may need to copy the content as a .crt file and send/upload it to a mail/cloud storage service that you use and download from that service to your headset. If it still fails, please file a bug report after connecting to a working Wi-Fi network.
    [/BLOCKQUOTE]
     
    That eventually worked for me, with some obstacles:
     
    *  The newly installed "2038 USERTrust RSA Certification Authority root certificate" did not immediately appear in the "certificate selection dropdown menu", but after several minutes and several tries, it did appear.  Not sure what I might have done wrong initially, or what I did differently to make it finally appear.  Maybe it was a matter of completely exiting the Wi-Fi settings and then coming back to them again.
     
    *  When I first tried to use the new certificate with the secure Wi-Fi SSID, I was left in a model Edit dialog, with two buttons: Cancel, and Save.  Save seemed to have no effect, it wouldn't close the dialog to allow me to try to connect.  Cancel closed the dialog, but without evidently saving anything.  It still failed to connect.
     
    *  I tried again today, but started in the Wi-Fi settings with "+ New network" where I was able to select the downloaded certificate. I gave the "new network" the same old SSID name.  I thought it might complain that that SSID already existed, but it did not; so I presume it replaced the settings for for that SSID.  Instead of merely a "Save" button, I had a "Connect" button, and it succeeded in connecting.
     
    *  In retrospect, I can't remember whether I did "Forget" on the SSID before trying to "Edit" it with the certificate.  Maybe I could have avoided the "+ New network" step.  But in any case, that wasn't any harder than "Forget"; just a different menu click.
     
    Best wishes to all.
     

42 Replies

  • Did you ever get this working twhall ? I am having similar issues. In particular the Domain option is not even present anymore under PEAP/MSCHAPV2 on the Quest 2 or Quest 3. Furthermore the 'connect' button is permanently greyed out even with all fields correctly filled (probably because the Domain field is not filled in because it doesn't exist in the UI like it should / sounds like it did).

    ThyRuinedKingis there anyway to access the android settings of the headset directly to bypass the (what seems to be incorrect) Meta UI?

    • twhall's avatar
      twhall
      Expert Protege

      xRagnorokx "  No, not really.   Fortunately, my university offers a few levels of Wi-Fi access that were sufficient to at least get through the setup.

      * We have a "guest" network that doesn't require authorization, but provides little more than web browsing; most ports are closed.  But this is sufficient for me to establish enough of a connection to look at the details and get the MAC address.

      * I can then go to a university website and register that MAC address on my account

      * Having done that, I can then connect to a "setup" network (intended I guess for IoT and other stuff) that provides enough access to complete the Quest device setup.  The "connect" button turns blue.  [The choice of "setup" as the service name is merely coincidental with the fact that it works for Quest setup.  The university offers it as a mechanism for setting up any kind of device by virtue of pre-registering its MAC address, I guess as an alternative to the domain and system-certificate authentication.]

      * Sometimes, after having gone through that, I can then connect to the fully-privileged wireless network, but have not needed to, so haven't thoroughly tested it.  I had an appointment with an IT guy in August to try to debug the connection issue, to verify whether the Quest was sending the correct Domain and System Certificate info.  But then the university was hit with a serious security breach, and a conscious decision was made to disconnect the entire university from the Internet -- right at the beginning of the semester -- until they had a chance to asses the damage, repair, and institute new security measures before reconnecting.  The IT guys worked round-the-clock for several days to get the university back on-line, the Quest-authentication debugging got put on hold, and we've never picked it up again.

      Quest has been typically useless in helping to resolve the issue.  I've never gotten any assurance from them that they've tested the Domain and System Certificate functionality to verify that the user input is retained and used, or any explanation of why it's not retained in the user interface.  I don't get the sense that they've even read my comment, or understood it.  Very frustrating; lousy tech support.

      • zmedic's avatar
        zmedic
        Honored Guest

        I am unfortunately facing the same issue exactly, other android devices are able to connect with the instructions given by our institutions IT, but not the quest devices. Unfortunately in the same boat. I can only join the guest network at work with very limited functionality. Please get this fixed!

        Thanks twhall for raising this issue in great detail, I couldn't have described it as clearly as you have

  • twhall's avatar
    twhall
    Expert Protege

    Your answer is not helpful, as I have explained above.

    The evidence is that the Meta Quest Pro is not retaining or using the settings for CA Certificate and Domain.  Therefore, it fails to authenticate.  No other "private protocol" requires changing here.  This is the only device type that fails to authenticate on our network.  All other devices, including other XR devices -- including for example the Microsoft HoloLens -- authenticate and connect successfully, with full access to the Internet.

    • MetaStoreHelp's avatar
      MetaStoreHelp
      Community Manager

      Hey there, twhall. We understand that this isn't the response you had hoped for, but as mentioned we are unable to assist with making changes to private networks. The security of our users is one of our highest priorities, and troubleshooting a private network could compromise that security. We appreciate your understanding and we hope you enjoy the rest of your day!

      • twhall's avatar
        twhall
        Expert Protege

        I have not asked you to "make changes to a private network."  I have asked for information, some kind of hint, as to why connection to a private network might fail.

        Does the Meta Quest Pro support WPA2?

  • MetaStoreHelp's avatar
    MetaStoreHelp
    Community Manager

    Hey there, twhall! We completely understand that you're having difficulties connecting to Wi-Fi for the first time. So we'd like to assist you by providing you with some reasons why the headsets aren't connecting to Wi-Fi.

     

    Companies, organizations, and schools may not always be able to access some of our feature while connected to their network because their networks may be secured. No matter how much we want to assist a secured or private network, it requires modifying private protocols. For assistance, so the best option will be to contact the network administrator, IT department, or whoever put up the network so that you could connect the headset to the internet.

    • twhall's avatar
      twhall
      Expert Protege

      When it comes to XR stuff on this campus, we are the people that the IT department looks to for guidance.  They have guidance for how to connect Android devices to the network, which we have followed.  You haven't given me any information that I can take back to them regarding any additional access requirements that they're not meeting.

      You also have not responded to my observation that the Quest Pro does not seem to retain the settings for CA Certificate and Domain, which appears to me to be the most likely cause of the failure to authenticate.

      We routinely connect many other devices to this WiFi network, including Microsoft HoloLenses, as well as various notebooks, tablets, and other mobile things, with unfettered access.  If the Quest Pro needs something unusual in terms of IP port access simply to get through the device setup, please provide specific information on what that is.

      Please verify that there isn't a bug in the WiFi settings dialog that prevents it from properly applying the Use system certificates selection and Domain name entry.  In any case, please fix the settings dialog so that it retains those selections (as it retains other fields) so that I don't have to repeatedly reset them.

      • MetaStoreHelp's avatar
        MetaStoreHelp
        Community Manager

        It's wonderful to hear from you again! As much as we'd like to assist you in connecting to Wi-Fi if it's a secure internet connection, the best solution will be to contact the IT from the campus so that they can assist you further. You could also try connecting it to a different internet connection during the initial setup.