Radius Terminate Capture

These scenarios show different acct-terminate-causes that are sent by OSDx devices when 802.1x sessions end.

../../../../../../../_images/causes.svg

Test 802.1x User Request Cause

Description

This scenario shows how to stop an 802.1x session using operational command supplicant disconnect. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=1.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19lmZp5K46R/3Rn7UOQHbt/0VoHE2bjZaK+K13gIOmw5/mIvVGYXnM2Mi4D+8EXoB4A5JXjzqQfaA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.829 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.829/0.829/0.829/0.000 ms

Step 4: Set the following configuration in DUT1:

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX196kJLLVRkni3Q6PF3sx9m8RqVgygcJFYk=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.534 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.534/0.534/0.534/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x supplicant disconnect at DUT1 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:01:59.663431 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 24138, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.44217 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xedbc!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: aeb0f0ef103e56037c522c87adc3b145
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: 7B0E855C1E50BAEC
            0x0000:  3742 3045 3835 3543 3145 3530 4241 4543
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Feb  3 16:01:58 2025
            0x0000:  67a0 e876
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: User Request
            0x0000:  0000 0001
1 packet captured

Test 802.1x Lost Carrier Cause

Description

This scenario shows how an 802.1x session is stopped after a link down event in DUT0 eth1. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=2.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX19rCvtHIQuxnp8IKe6bnM7RPR+l6/ZwaJ0=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18TxDkABLf9K9xaBM1ukbLDL1oBWCIVoZbWnlEUjjYhPefq6h0IJcb7qyqpKMeSfbx6HJVfSiDTrQ==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.650 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.650/0.650/0.650/0.000 ms

Step 4: Set the following configuration in DUT1:

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1+lyOcF5HvKLQvkJWXv4d02ikSfWB7z3jI=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.569 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.569/0.569/0.569/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Remove the link between DUT0 and DUT1 to provoke a link-down event.

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:02:17.602399 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 55931, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.38340 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x7f5b!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 47cd547d64bb77096061bd249e211693
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: C411EE936CE1C7FA
            0x0000:  4334 3131 4545 3933 3643 4531 4337 4641
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Feb  3 16:02:17 2025
            0x0000:  67a0 e889
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Lost Carrier
            0x0000:  0000 0002
1 packet captured

Test 802.1x Idle Timeout Cause

Description

This scenario shows how an 802.1x session is stopped after a reauthentication timeout. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=4.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator max-retransmissions 2
set interfaces ethernet eth1 802.1x authenticator reauth-period 15
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18XEqK6rhJfvXGPSs2/IxixsaUiN8eKUjk7Ozw9FaVv0hdFAS3AwzLAvndYhUmSbOSyD0lP7t/G5g==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.711 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.711/0.711/0.711/0.000 ms

Step 4: Set the following configuration in DUT1:

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1+RUrOKPToAF0DFEb5nmCt0ZeaCNGZEBeg=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate               TRUE
Reauthenticate Period          15
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.516 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.516/0.516/0.516/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Disable DUT1 interface or remove address configuration to prevent the device from responding EAP requests.

Step 9: Modify the following configuration lines in DUT1:

set interfaces ethernet eth1 disable

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:03:17.197011 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 8496, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.49664 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x0704!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: bc163d5a543d2069e0a4587ee361cfb3
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: D40F7DA019843BEA
            0x0000:  4434 3046 3744 4130 3139 3834 3342 4541
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Feb  3 16:03:16 2025
            0x0000:  67a0 e8c4
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 41 secs
            0x0000:  0000 0029
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Idle Timeout
            0x0000:  0000 0004
1 packet captured

Test 802.1x Admin Reset Cause

Description

This scenario shows how to stop an 802.1x session using operational command authenticator disassociate. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18sBATm8dbst/tLX2xN8BMNAD9O++Z2YIO9dhn5urFyu/ZBtHLPiTQYxP9+pB28+dJ5prrzFXXk4A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.607 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.607/0.607/0.607/0.000 ms

Step 4: Set the following configuration in DUT1:

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1/4hVyi8RCVh+n1MGIEYbBtt9E/dcBS0aI=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.505 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.505/0.505/0.505/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x authenticator disassociate at DUT0 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:03:34.623562 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 57820, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.43022 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xd0e8!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 024544416c7c4c0d01ed0dde7aa52bf2
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: E966275591E32FDD
            0x0000:  4539 3636 3237 3535 3931 4533 3246 4444
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Feb  3 16:03:34 2025
            0x0000:  67a0 e8d6
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test 802.1x NAS Request Cause

Description

This scenario shows how to stop an 802.1x session from the authentication server using a CoA message. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=10.

Scenario

Step 1: Set the following configuration in DUT2:

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0:

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX1+S/dHqv5z/a3b8Zwe87fnC5r0zrstnoxw=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+AQP/vhpQAQCDEac6ZHH4mtcJHhrAqBuPtnOzACIx0Z2TAn1iy+nIfGRmG68fBGx3RI5lhktz8Ww==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.803 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.803/0.803/0.803/0.000 ms

Step 4: Set the following configuration in DUT1:

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX18onrTGZI24IbdBvDqkAETXzPwlILdJBuE=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.564 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.564/0.564/0.564/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Send a CoA/Disconnect request from the RADIUS server On Linux, the FreeRADIUS package includes the utility radtest that can be used to send these messages:

Show output
$ cat /osdx-tests/utils/dot1x/auth.req
User-Name = "testing"
$ radclient -s -t 1 -r 1 10.215.168.64:3799 disconnect coa_secret -f /osdx-tests/utils/dot1x/auth.req
Sent Disconnect-Request Id 194 from 0.0.0.0:35162 to 10.215.168.64:3799 length 29
Received Disconnect-ACK Id 194 from 10.215.168.64:3799 to 10.215.168.1:35162 length 44
Packet summary:
      Accepted      : 1
      Rejected      : 0
      Lost          : 0
      Passed filter : 1
      Failed filter : 0

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
16:03:53.506472 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 57178, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.59183 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xbb2c!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: a3caa99540d204c9e25510e33f079fc1
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: 97FA10CB8AEF20E8
            0x0000:  3937 4641 3130 4342 3841 4546 3230 4538
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Feb  3 16:03:52 2025
            0x0000:  67a0 e8e8
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: NAS Request
            0x0000:  0000 000a
1 packet captured