Mab Fallback
This scenario shows how to configure the MAB-fallback
authentication mode.
Test Successful 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19LupHOS5vFOY2gL2PamSUXfvJhkbkXh8RU0yenb9yb5QR91Fr+LzQz9mDYBydlywu9Xf37wqTrlw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.475 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.475/0.475/0.475/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/jWpphC7mIY2D6In94vwvr9FNRbeC+JKs= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.275 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.275/0.275/0.275/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Jul 24 15:28:12.547589 osdx hostapd[1070498]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:28:12.547603 osdx hostapd[1070498]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:12.547804 osdx hostapd[1070498]: connect[radius]: Network is unreachable Jul 24 15:28:12.547638 osdx hostapd[1070498]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:28:12.547641 osdx hostapd[1070498]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:28:12.583419 osdx hostapd[1070498]: Discovery mode enabled on eth1 Jul 24 15:28:12.583500 osdx hostapd[1070498]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:28:12.583500 osdx hostapd[1070498]: eth1: AP-ENABLED Jul 24 15:28:16.004661 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:28:16.004675 osdx hostapd[1070499]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:28:16.019512 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:28:16.019547 osdx hostapd[1070499]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:28:16.019552 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:28:16.019555 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:28:16.019577 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Jul 24 15:28:16.019580 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:28:16.019591 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:28:16.019605 osdx hostapd[1070499]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:28:16.019621 osdx hostapd[1070499]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:28:16.019635 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 179) Jul 24 15:28:16.020074 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=179 len=12) from STA: EAP Response-Identity (1) Jul 24 15:28:16.020089 osdx hostapd[1070499]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:28:16.020093 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Jul 24 15:28:16.020126 osdx hostapd[1070499]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:16.022509 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.022680 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.022905 osdx hostapd[1070499]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:28:16.022912 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.022916 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.022945 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=180 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:28:16.022954 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 180) Jul 24 15:28:16.023302 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=180 len=6) from STA: EAP Response-unknown (3) Jul 24 15:28:16.023381 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.023473 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.023630 osdx hostapd[1070499]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:28:16.023633 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.023636 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.023660 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=181 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.023668 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 181) Jul 24 15:28:16.024087 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=181 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.024143 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.024160 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.025168 osdx hostapd[1070499]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:28:16.025176 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.025179 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.025214 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=182 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.025221 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 182) Jul 24 15:28:16.025487 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=182 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.025554 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.025574 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.025744 osdx hostapd[1070499]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:28:16.025751 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.025755 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.025775 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=183 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.025783 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 183) Jul 24 15:28:16.027274 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=183 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.027340 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.027360 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.027673 osdx hostapd[1070499]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:28:16.027681 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.027690 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.027708 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=184 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.027716 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 184) Jul 24 15:28:16.028055 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=184 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.028104 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.028160 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.028272 osdx hostapd[1070499]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:28:16.028279 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.028283 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.028301 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=185 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.028308 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 185) Jul 24 15:28:16.028619 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=185 len=43) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.028662 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.028676 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.028894 osdx hostapd[1070499]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:28:16.028901 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.028904 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.028934 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=186 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.028942 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 186) Jul 24 15:28:16.029259 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=186 len=97) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.029303 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.029315 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.029574 osdx hostapd[1070499]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 15:28:16.029581 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.029586 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.029608 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=187 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.029616 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 187) Jul 24 15:28:16.029866 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=187 len=37) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.029906 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.029916 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.030105 osdx hostapd[1070499]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:28:16.030113 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.030118 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.030140 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=188 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:16.030148 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 188) Jul 24 15:28:16.030397 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=188 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:28:16.030439 osdx hostapd[1070499]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:16.030650 osdx hostapd[1070499]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:16.030665 osdx hostapd[1070499]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 15:28:16.030668 osdx hostapd[1070499]: eth1: RADIUS Received RADIUS message Jul 24 15:28:16.030672 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:16.030703 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 15:28:16.030708 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=188 len=4) from RADIUS server: EAP Success Jul 24 15:28:16.030728 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 188) Jul 24 15:28:16.030745 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:28:16.030749 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 8C1F7EC9E85815E0 Jul 24 15:28:16.030753 osdx hostapd[1070499]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Successful 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses the correct username and password, but an incorrect MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX197lcnNK2uZj4d66Wdjd9mNoOU1EJEmiH2LUgFdRVXxYvm+ZDLMCo2aBXKFU9XIg9Gunkf1KZaQ/Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.297 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.297/0.297/0.297/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/QBAvWRhB3riAkr8hH9mrsHLoZQcU+8Vc= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.318 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.318/0.318/0.318/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Jul 24 15:28:26.715350 osdx hostapd[1071076]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:28:26.715365 osdx hostapd[1071076]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:26.715639 osdx hostapd[1071076]: connect[radius]: Network is unreachable Jul 24 15:28:26.715407 osdx hostapd[1071076]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:28:26.715410 osdx hostapd[1071076]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:28:26.735175 osdx hostapd[1071076]: Discovery mode enabled on eth1 Jul 24 15:28:26.735279 osdx hostapd[1071076]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:28:26.735279 osdx hostapd[1071076]: eth1: AP-ENABLED Jul 24 15:28:30.286451 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:28:30.286467 osdx hostapd[1071077]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:28:30.299239 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Jul 24 15:28:30.299270 osdx hostapd[1071077]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:28:30.299276 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:28:30.299279 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:28:30.299298 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Jul 24 15:28:30.299301 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:28:30.299312 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Jul 24 15:28:30.299321 osdx hostapd[1071077]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:28:30.299334 osdx hostapd[1071077]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:28:30.299351 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 108) Jul 24 15:28:30.299791 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=108 len=12) from STA: EAP Response-Identity (1) Jul 24 15:28:30.299803 osdx hostapd[1071077]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:28:30.299808 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'testing' Jul 24 15:28:30.299832 osdx hostapd[1071077]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:30.302045 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.302077 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.302363 osdx hostapd[1071077]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:28:30.302369 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.302374 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.302395 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=109 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:28:30.302402 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 109) Jul 24 15:28:30.302690 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=109 len=6) from STA: EAP Response-unknown (3) Jul 24 15:28:30.302758 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.302775 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.302993 osdx hostapd[1071077]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:28:30.302998 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.303001 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.303025 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=110 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.303032 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 110) Jul 24 15:28:30.303440 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=110 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.303503 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.303519 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.304626 osdx hostapd[1071077]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:28:30.304633 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.304637 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.304661 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=111 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.304669 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 111) Jul 24 15:28:30.304900 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=111 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.304958 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.304973 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.305128 osdx hostapd[1071077]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:28:30.305135 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.305138 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.305156 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=112 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.305164 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 112) Jul 24 15:28:30.306885 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=112 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.306952 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.306966 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.307290 osdx hostapd[1071077]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:28:30.307297 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.307302 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.307322 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=113 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.307329 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 113) Jul 24 15:28:30.307655 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=113 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.307700 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.307715 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.307843 osdx hostapd[1071077]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:28:30.307850 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.307855 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.307872 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=114 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.307879 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 114) Jul 24 15:28:30.308093 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=114 len=43) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.308134 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.308147 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.308336 osdx hostapd[1071077]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:28:30.308343 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.308347 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.308365 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=115 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.308371 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 115) Jul 24 15:28:30.308695 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=115 len=97) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.308739 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.308752 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.308934 osdx hostapd[1071077]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 15:28:30.308940 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.308945 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.308960 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=116 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.308967 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 116) Jul 24 15:28:30.309219 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=116 len=37) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.309275 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.309303 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.309460 osdx hostapd[1071077]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:28:30.309465 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.309469 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.309486 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=117 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:30.309492 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 117) Jul 24 15:28:30.309727 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=117 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:28:30.309772 osdx hostapd[1071077]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:30.309784 osdx hostapd[1071077]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:30.309967 osdx hostapd[1071077]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 15:28:30.309974 osdx hostapd[1071077]: eth1: RADIUS Received RADIUS message Jul 24 15:28:30.309978 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:30.310008 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 15:28:30.310012 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=3 id=117 len=4) from RADIUS server: EAP Success Jul 24 15:28:30.310031 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 117) Jul 24 15:28:30.310048 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authorizing port Jul 24 15:28:30.310055 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 RADIUS: starting accounting session 940293938405097F Jul 24 15:28:30.310059 osdx hostapd[1071077]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+dh/gEXnNZLHrbrbvK5LW1dBfx8locemBnGhfcPYncCvNcM5i29vVqSGWbzkpl0RnnCu1scM86kw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.499 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.499/0.499/0.499/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/U68+bnsQE3gHe4HtXK617M/FabRfMz1c= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name wrong
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.781 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.781/0.781/0.781/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately 802.1X: MAB: station successfully authenticatedShow output
Jul 24 15:28:40.297545 osdx hostapd[1071651]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:28:40.297566 osdx hostapd[1071651]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:40.297830 osdx hostapd[1071651]: connect[radius]: Network is unreachable Jul 24 15:28:40.297611 osdx hostapd[1071651]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:28:40.297615 osdx hostapd[1071651]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:28:40.321306 osdx hostapd[1071651]: Discovery mode enabled on eth1 Jul 24 15:28:40.321398 osdx hostapd[1071651]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:28:40.321398 osdx hostapd[1071651]: eth1: AP-ENABLED Jul 24 15:28:43.839478 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:28:43.839492 osdx hostapd[1071652]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:28:43.853340 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:28:43.853369 osdx hostapd[1071652]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:28:43.853373 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:28:43.853375 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:28:43.853390 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Jul 24 15:28:43.853392 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:28:43.853401 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:28:43.853410 osdx hostapd[1071652]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:28:43.853428 osdx hostapd[1071652]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:28:43.853439 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 250) Jul 24 15:28:43.853861 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=250 len=10) from STA: EAP Response-Identity (1) Jul 24 15:28:43.853874 osdx hostapd[1071652]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:28:43.853878 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'wrong' Jul 24 15:28:43.853912 osdx hostapd[1071652]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:43.855980 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.856008 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.856312 osdx hostapd[1071652]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:28:43.856322 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.856327 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.856358 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=251 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:28:43.856373 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 251) Jul 24 15:28:43.856667 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=251 len=6) from STA: EAP Response-unknown (3) Jul 24 15:28:43.856725 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.856743 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.856934 osdx hostapd[1071652]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:28:43.856942 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.856946 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.856965 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=252 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.856972 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 252) Jul 24 15:28:43.857438 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=252 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.857488 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.857520 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.858459 osdx hostapd[1071652]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:28:43.858469 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.858473 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.858501 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=253 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.858512 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 253) Jul 24 15:28:43.858813 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=253 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.858864 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.858913 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.859018 osdx hostapd[1071652]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:28:43.859024 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.859028 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.859056 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=254 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.859063 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 254) Jul 24 15:28:43.860608 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=254 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.860671 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.860719 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.860997 osdx hostapd[1071652]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:28:43.861004 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.861008 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.861029 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=255 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.861035 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 255) Jul 24 15:28:43.861384 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=255 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.861447 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.861463 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.861624 osdx hostapd[1071652]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:28:43.861631 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.861636 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.861665 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=0 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.861679 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 0) Jul 24 15:28:43.861965 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=0 len=41) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.862008 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.862020 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.862181 osdx hostapd[1071652]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:28:43.862188 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.862192 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.862215 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=1 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.862222 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 1) Jul 24 15:28:43.862617 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=1 len=95) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.862668 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.862757 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:43.862878 osdx hostapd[1071652]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:28:43.862886 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:43.862890 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:43.862912 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=2 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:43.862919 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 2) Jul 24 15:28:43.863142 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=2 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:28:43.863186 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:43.863252 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:44.863363 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=8) Jul 24 15:28:44.863405 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:28:44.863636 osdx hostapd[1071652]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:28:44.863642 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:44.863647 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:44.863703 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=4 id=2 len=4) from RADIUS server: EAP Failure Jul 24 15:28:44.863734 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 2) Jul 24 15:28:44.863750 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:28:44.863755 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Jul 24 15:28:44.863759 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately Jul 24 15:28:44.863763 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:28:44.863797 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 15:28:44.863805 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 15:28:44.863823 osdx hostapd[1071652]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:44.863835 osdx hostapd[1071652]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:44.863849 osdx hostapd[1071652]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:28:44.863852 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:44.863855 osdx hostapd[1071652]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet Jul 24 15:28:44.864888 osdx hostapd[1071652]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:28:44.864898 osdx hostapd[1071652]: eth1: RADIUS Received RADIUS message Jul 24 15:28:44.864903 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:44.864908 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:28:44.864937 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 15:28:44.864941 osdx hostapd[1071652]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:28:44.864950 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:28:44.864954 osdx hostapd[1071652]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 7E19B64CCAADC12F
Test Unsuccessful 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses an incorrect username and MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+/rGjpqvGABV0mp2c+ELQ7pcBiMkIIpIO0uoSWJlTEKKr/9nBl0Rdc2ZntrvEb7JcxwqYJKkS0Hg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.357 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.357/0.357/0.357/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX190WrEhirkugNVO33b3wukHEm5PTn3wl+4= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 6: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately 802.1X: MAB: Authentication failedShow output
Jul 24 15:28:53.353412 osdx hostapd[1072228]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:28:53.353423 osdx hostapd[1072228]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:53.353709 osdx hostapd[1072228]: connect[radius]: Network is unreachable Jul 24 15:28:53.353458 osdx hostapd[1072228]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:28:53.353461 osdx hostapd[1072228]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:28:53.385215 osdx hostapd[1072228]: Discovery mode enabled on eth1 Jul 24 15:28:53.385309 osdx hostapd[1072228]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:28:53.385309 osdx hostapd[1072228]: eth1: AP-ENABLED Jul 24 15:28:57.065454 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:28:57.065471 osdx hostapd[1072229]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:28:57.081283 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Jul 24 15:28:57.081313 osdx hostapd[1072229]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:28:57.081317 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:28:57.081320 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:28:57.081337 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Jul 24 15:28:57.081340 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:28:57.081350 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Jul 24 15:28:57.081357 osdx hostapd[1072229]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:28:57.081370 osdx hostapd[1072229]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:28:57.081380 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 116) Jul 24 15:28:57.081833 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=116 len=10) from STA: EAP Response-Identity (1) Jul 24 15:28:57.081846 osdx hostapd[1072229]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:28:57.081850 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'wrong' Jul 24 15:28:57.081879 osdx hostapd[1072229]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:28:57.083707 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.083736 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.083978 osdx hostapd[1072229]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:28:57.083985 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.083988 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.084015 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=117 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:28:57.084022 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 117) Jul 24 15:28:57.084292 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=117 len=6) from STA: EAP Response-unknown (3) Jul 24 15:28:57.084348 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.084361 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.084548 osdx hostapd[1072229]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:28:57.084553 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.084556 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.084571 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=118 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.084576 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 118) Jul 24 15:28:57.084953 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=118 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.085005 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.085019 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.085885 osdx hostapd[1072229]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:28:57.085892 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.085898 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.085922 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=119 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.085929 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 119) Jul 24 15:28:57.086140 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=119 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.086187 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.086203 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.086355 osdx hostapd[1072229]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:28:57.086361 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.086364 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.086387 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=120 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.086395 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 120) Jul 24 15:28:57.087856 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=120 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.087929 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.087947 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.088261 osdx hostapd[1072229]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:28:57.088267 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.088271 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.088295 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=121 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.088302 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 121) Jul 24 15:28:57.088617 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=121 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.088676 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.088691 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.088865 osdx hostapd[1072229]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:28:57.088871 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.088876 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.088896 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=122 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.088903 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 122) Jul 24 15:28:57.089143 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=122 len=41) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.089214 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.089284 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.089416 osdx hostapd[1072229]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:28:57.089422 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.089427 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.089447 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=123 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.089455 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 123) Jul 24 15:28:57.089846 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=123 len=95) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.089898 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.089913 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:57.090141 osdx hostapd[1072229]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:28:57.090147 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:57.090150 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:57.090169 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=124 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:28:57.090176 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 124) Jul 24 15:28:57.090415 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=124 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:28:57.090459 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:57.090476 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:58.090592 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=8) Jul 24 15:28:58.090632 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:28:58.090827 osdx hostapd[1072229]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:28:58.090831 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:58.090835 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:58.090884 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=4 id=124 len=4) from RADIUS server: EAP Failure Jul 24 15:28:58.090911 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 124) Jul 24 15:28:58.090926 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Jul 24 15:28:58.090930 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Jul 24 15:28:58.090934 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately Jul 24 15:28:58.090938 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:28:58.090966 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Jul 24 15:28:58.090982 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Jul 24 15:28:58.090995 osdx hostapd[1072229]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:28:58.091008 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:28:58.091021 osdx hostapd[1072229]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:28:58.091024 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:58.091044 osdx hostapd[1072229]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet Jul 24 15:28:59.091093 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Jul 24 15:28:59.091125 osdx hostapd[1072229]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:28:59.091399 osdx hostapd[1072229]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:28:59.091405 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:59.091409 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:28:59.091413 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:28:59.091455 osdx hostapd[1072229]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:28:59.091457 osdx hostapd[1072229]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:28:59.091460 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Authentication failed, entering held state (quiet period 60 sec) Jul 24 15:28:59.091462 osdx hostapd[1072229]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Retry timeout registered for 60 seconds Jul 24 15:28:59.091469 osdx hostapd[1072229]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:28:59.091471 osdx hostapd[1072229]: eth1: RADIUS Received RADIUS message Jul 24 15:28:59.091473 osdx hostapd[1072229]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet
Test Unsupported 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+O1p51CRqWcdjgGIqUKGHJUDJwg7txfLKWT3nWB3W+tZXsSA0Kt2ireXkTb/jvwb5R60TZdK1rxg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.192 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.192/0.192/0.192/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.607 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.607/0.607/0.607/0.000 ms
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 4 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.286 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.286/0.286/0.286/0.000 ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately 802.1X: MAB: station successfully authenticatedShow output
Jul 24 15:29:08.282302 osdx hostapd[1072793]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:29:08.282314 osdx hostapd[1072793]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:29:08.282593 osdx hostapd[1072793]: connect[radius]: Network is unreachable Jul 24 15:29:08.282355 osdx hostapd[1072793]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:29:08.282358 osdx hostapd[1072793]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:29:08.298120 osdx hostapd[1072793]: Discovery mode enabled on eth1 Jul 24 15:29:08.298239 osdx hostapd[1072793]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:29:08.298239 osdx hostapd[1072793]: eth1: AP-ENABLED Jul 24 15:29:13.298682 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 15:29:13.298733 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:29:13.298742 osdx hostapd[1072794]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:29:13.326228 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:29:13.326267 osdx hostapd[1072794]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:29:13.326272 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:29:13.326275 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:29:13.326299 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:29:13.326308 osdx hostapd[1072794]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:29:13.326335 osdx hostapd[1072794]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:29:13.326350 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 143) Jul 24 15:29:16.328989 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 143) Jul 24 15:29:22.334003 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 143) Jul 24 15:29:34.343667 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication Jul 24 15:29:34.343674 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately Jul 24 15:29:34.343678 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:29:34.343714 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 15:29:34.345466 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 15:29:34.345477 osdx hostapd[1072794]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:29:34.345547 osdx hostapd[1072794]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:29:34.345575 osdx hostapd[1072794]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:29:34.345597 osdx hostapd[1072794]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:29:34.345604 osdx hostapd[1072794]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:29:34.345615 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 28) Jul 24 15:29:34.345885 osdx hostapd[1072794]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:29:34.345890 osdx hostapd[1072794]: eth1: RADIUS Received RADIUS message Jul 24 15:29:34.345897 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:29:34.345900 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:29:34.345910 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 15:29:34.345921 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 15:29:34.345924 osdx hostapd[1072794]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:29:34.345931 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:29:34.345934 osdx hostapd[1072794]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 719DC0544DF57F89
Test Unsupported 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 does not support 802.1x authentication and uses an incorrect MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+CnBkqwqeWn1VDslj+5SZV8/OHOIbouG592Szifvw8+kTBmeRKrBllKcVMeCTOTaPO3AkysVNb3Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.273 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.273/0.273/0.273/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 2 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 4 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 5: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately 802.1X: MAB: Authentication failedShow output
Jul 24 15:29:46.618249 osdx hostapd[1073413]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:29:46.618264 osdx hostapd[1073413]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:29:46.618555 osdx hostapd[1073413]: connect[radius]: Network is unreachable Jul 24 15:29:46.618302 osdx hostapd[1073413]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:29:46.618305 osdx hostapd[1073413]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:29:46.642174 osdx hostapd[1073413]: Discovery mode enabled on eth1 Jul 24 15:29:46.642272 osdx hostapd[1073413]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:29:46.642272 osdx hostapd[1073413]: eth1: AP-ENABLED Jul 24 15:29:51.642193 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 DRIVER: Device discovered, triggering MAB authentication Jul 24 15:29:51.642246 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:29:51.642257 osdx hostapd[1073414]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:29:51.662140 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Jul 24 15:29:51.662167 osdx hostapd[1073414]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:29:51.662171 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 15:29:51.662174 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 15:29:51.662191 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Jul 24 15:29:51.662201 osdx hostapd[1073414]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:29:51.662222 osdx hostapd[1073414]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:29:51.662233 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 82) Jul 24 15:29:54.664930 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 82) Jul 24 15:30:00.669931 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 82) Jul 24 15:30:12.679632 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: aborting authentication Jul 24 15:30:12.679639 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately Jul 24 15:30:12.679656 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:30:12.679687 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Jul 24 15:30:12.681402 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Jul 24 15:30:12.681412 osdx hostapd[1073414]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:30:12.681484 osdx hostapd[1073414]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:30:12.681515 osdx hostapd[1073414]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:30:12.681538 osdx hostapd[1073414]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:30:12.681549 osdx hostapd[1073414]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:30:12.681561 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 201) Jul 24 15:30:13.681912 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Jul 24 15:30:13.681955 osdx hostapd[1073414]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:30:13.682180 osdx hostapd[1073414]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:30:13.682187 osdx hostapd[1073414]: eth1: RADIUS Received RADIUS message Jul 24 15:30:13.682193 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:30:13.682198 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:30:13.682247 osdx hostapd[1073414]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:30:13.682251 osdx hostapd[1073414]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:30:13.682254 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Authentication failed, entering held state (quiet period 60 sec) Jul 24 15:30:13.682257 osdx hostapd[1073414]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Retry timeout registered for 60 seconds Jul 24 15:30:13.682265 osdx hostapd[1073414]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:30:13.682268 osdx hostapd[1073414]: eth1: RADIUS Received RADIUS message Jul 24 15:30:13.682271 osdx hostapd[1073414]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet