SSID: eduroam

This wireless network allows secure access to services for students, staff and guests. The authentication with a valid username and password is needed, before access to the network ist granted. This technique is based on the standard IEEE 802.1x.

There are different implementations of the protocol EAP used for authentication and exchange of cryptographic key information. To support the specific protocol which is used by the access point a specific software (called supplicant) is required.

For technical reasons, the protocol used for members of the TUHH is EAP-TTLS. Many operating systems support this protocol without the need of additional software.

Guests may access this network as it is part of the eduroam Project by using the supplicant of their home institution. After connecting, they will have access to the Guest Network.

see https://monitor.eduroam.org/map_service_loc.php

Connect

For all operating systems, there are some configuration steps to be performed, before a connection with this wireless network can be established.

After the supplicant is configured properly, choose the wireless network eduroam from the list of available networks.
Once your login information has been verified, your device automatically receives an IP address and you will be able to use the network.

Limitations

Members of the university are in the TUHH intranet after logging in. For security reasons, the following restrictions still apply when accessing the Internet:

• Unencrypted access to exteral e-mail server (TCP Port 25) is not allowed.
• TCP ports 135, 139 and 445 are blocked.
• UDP ports 137, 138 and 445 are blocked.

Guests who log in to eduroam as part of the DFNRoaming get access to the Guest Network (Veranstaltungsnetz). During the first access a Webpage with hints regarding these restrictions and data protection will be shown (Captive Portal). Logfiles regarding the authentication at the home institution will be kept for 7 days for troubleshooting purposes.

Configuration details of the supplicant

Unfortunately, we do not provide instructions for all operation systems, particularly of smartphones, so you need to help yourself. If you have succeeded to connect your device to the network feel free to provide a guide and contribute to the help pages.

• Network Name: eduroam
• Network Authentication: WPA2
• Data Encryption: AES
• Network Type: Infrastructure
• User Authentication: EAP-TTLS (EAP with tunneled TLS)
• CA Certificate: Root Certificate DFN-Verein Community Root CA 2022
• Server certificate issued to radius-wlan.rz.tuhh.de
  that means the radius server of the RZ presents you a certificate of the TUHH CA
• Outer Identity: eduroam@tuhh.de
• Inner Identity: transmit username and password via PAP, ie as username and password enter your RZ account name and Kerberos password
• Assignment of IP addresses: automatic/dynamic/DHCP

General troubleshooting information

• After connecting, you will receive a dynamically assigned IP address (via DHCP) from one of the network ranges:
  
  
  • Network block 134.28.176.0/20 means that the address starts with 134.28.176.X ... 134.28.191.X. The network mask is 255.255.240.0 and the default gateway is 134.28.176.1.
  • Network block 134.28.160.0/21 means that the address starts with 134.28.160.X ... 134.28.167.X. The network mask is 255.255.248.0 and the default gateway is 134.28.160.1.
• The default gateway should be reachable via ping 134.28.176.1 or ping 134.28.160.1.
• The name resolution (DNS) should work. It always should be possible to open https://www.tuhh.de in your web browser.
  The TUHH automatically assign you the servers 134.28.202.14 and 134.28.205.14.