Mab First
This scenario shows how to configure the MAB-first
authentication mode.
Test Successful MAB Authentication With Successful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses a correct MAC address and correct 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18f+Un9PSfNa8cK16ecDHC02Oa+COn7xJe2dNiQ29dESCeM0jU7qQuYVBvDjxFv+En11eL0Yjt20g== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.313 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.313/0.313/0.313/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/BvLjtD52nWYphMU/vR+fk1l+Vx90j6i0= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 1 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.742 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.742/0.742/0.742/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Jul 24 15:26:22.492415 osdx hostapd[1067028]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:26:22.492671 osdx hostapd[1067028]: connect[radius]: Network is unreachable Jul 24 15:26:22.492437 osdx hostapd[1067028]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:22.492475 osdx hostapd[1067028]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:26:22.492479 osdx hostapd[1067028]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:26:22.512169 osdx hostapd[1067028]: Discovery mode enabled on eth1 Jul 24 15:26:22.512262 osdx hostapd[1067028]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:26:22.512262 osdx hostapd[1067028]: eth1: AP-ENABLED Jul 24 15:26:25.858398 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:26:25.858413 osdx hostapd[1067029]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:26:25.872165 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:26:25.872191 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:26:25.872205 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 15:26:25.873907 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 15:26:25.873921 osdx hostapd[1067029]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:25.873990 osdx hostapd[1067029]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:26:25.874017 osdx hostapd[1067029]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:26:25.874039 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:26:25.874301 osdx hostapd[1067029]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:26:25.874306 osdx hostapd[1067029]: eth1: RADIUS Received RADIUS message Jul 24 15:26:25.874309 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:26:25.874312 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:26:25.874323 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 15:26:25.874335 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 15:26:25.874339 osdx hostapd[1067029]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:26:25.874347 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:26:25.874350 osdx hostapd[1067029]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session CD305BC3F74C2530
Test Successful MAB Authentication With Unsuccessful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses a correct MAC address, but wrong 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18MUPeMuF6lzf5vPDGHIMPVCrQmOfOP6TDqil/ZsyH+X16JQm86ZG/lsr9v8bFccX6bc9KWgINkNQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.327 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.327/0.327/0.327/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX18/9fHB1dg4gQLwMBpVKoqAY3T5x/pDdIc= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 1 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.327 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.327/0.327/0.327/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Jul 24 15:26:35.469815 osdx hostapd[1067606]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:26:35.469826 osdx hostapd[1067606]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:35.470077 osdx hostapd[1067606]: connect[radius]: Network is unreachable Jul 24 15:26:35.469856 osdx hostapd[1067606]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:26:35.469859 osdx hostapd[1067606]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:26:35.517611 osdx hostapd[1067606]: Discovery mode enabled on eth1 Jul 24 15:26:35.517696 osdx hostapd[1067606]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:26:35.517696 osdx hostapd[1067606]: eth1: AP-ENABLED Jul 24 15:26:39.027826 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:26:39.027841 osdx hostapd[1067607]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:26:39.041663 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:26:39.041692 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:26:39.041707 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 15:26:39.043485 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 15:26:39.043500 osdx hostapd[1067607]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:39.043580 osdx hostapd[1067607]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:26:39.043610 osdx hostapd[1067607]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:26:39.043642 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:26:39.043896 osdx hostapd[1067607]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:26:39.043902 osdx hostapd[1067607]: eth1: RADIUS Received RADIUS message Jul 24 15:26:39.043906 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:26:39.043910 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:26:39.043923 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 15:26:39.043935 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 15:26:39.043939 osdx hostapd[1067607]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:26:39.043948 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:26:39.043951 osdx hostapd[1067607]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 11D04640AD8D2157
Test Successful MAB Authentication With Unsupported 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/mGMqO3FDIEDfULoijoVqLt5yl+FWiBYzTeYG5p+d6VyUvIDAviQYLjT1xuRA7rAVBWNYfuvUG2w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.273 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.273/0.273/0.273/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.544 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.544/0.544/0.544/0.000 ms
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.502 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.502/0.502/0.502/0.000 ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Jul 24 15:26:48.601156 osdx hostapd[1068181]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:26:48.601174 osdx hostapd[1068181]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:48.601464 osdx hostapd[1068181]: connect[radius]: Network is unreachable Jul 24 15:26:48.601218 osdx hostapd[1068181]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:26:48.601222 osdx hostapd[1068181]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:26:48.624946 osdx hostapd[1068181]: Discovery mode enabled on eth1 Jul 24 15:26:48.625028 osdx hostapd[1068181]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:26:48.625028 osdx hostapd[1068181]: eth1: AP-ENABLED Jul 24 15:26:53.625470 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 15:26:53.625512 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:26:53.625524 osdx hostapd[1068182]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:26:53.640972 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:26:53.641003 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:26:53.641018 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 15:26:53.642725 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 15:26:53.642735 osdx hostapd[1068182]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:26:53.642815 osdx hostapd[1068182]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:26:53.642842 osdx hostapd[1068182]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:26:53.643115 osdx hostapd[1068182]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:26:53.643122 osdx hostapd[1068182]: eth1: RADIUS Received RADIUS message Jul 24 15:26:53.643126 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:26:53.643131 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:26:53.643142 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 15:26:53.643154 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 15:26:53.643158 osdx hostapd[1068182]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:26:53.643173 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:26:53.643177 osdx hostapd[1068182]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 16B1F97F50640D81
Test Unsuccessful MAB Authentication With Successful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses an incorrect MAC address, but correct 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19iHz1ZliyaJS78ZVTECGBuqAT2CtB91oK0OPaYcNMrbMySnHLeJ4VBDF69rxtAZ9yuoxU/a1vxSg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.337 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.337/0.337/0.337/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/mWCLk4bGD142uZ80LD5XQhyvdj7Pf3+4= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.454 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.454/0.454/0.454/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Jul 24 15:27:05.376053 osdx hostapd[1068766]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:27:05.376379 osdx hostapd[1068766]: connect[radius]: Network is unreachable Jul 24 15:27:05.376070 osdx hostapd[1068766]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:05.376129 osdx hostapd[1068766]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:27:05.376133 osdx hostapd[1068766]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:27:05.403736 osdx hostapd[1068766]: Discovery mode enabled on eth1 Jul 24 15:27:05.403844 osdx hostapd[1068766]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:27:05.403844 osdx hostapd[1068766]: eth1: AP-ENABLED Jul 24 15:27:09.203959 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:27:09.203975 osdx hostapd[1068767]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:27:09.223758 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:27:09.223798 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:27:09.223817 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Jul 24 15:27:09.225649 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Jul 24 15:27:09.225662 osdx hostapd[1068767]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:09.225751 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:09.225783 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:09.225817 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:27:10.225873 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Jul 24 15:27:10.225917 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:27:10.226099 osdx hostapd[1068767]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:27:10.226105 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.226110 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.226115 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:27:10.226169 osdx hostapd[1068767]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:27:10.226172 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Jul 24 15:27:10.226176 osdx hostapd[1068767]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:27:10.226180 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Jul 24 15:27:10.226187 osdx hostapd[1068767]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:27:10.226196 osdx hostapd[1068767]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:27:10.226207 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 145) Jul 24 15:27:10.226227 osdx hostapd[1068767]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:27:10.226231 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.226234 osdx hostapd[1068767]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet Jul 24 15:27:10.226515 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=145 len=12) from STA: EAP Response-Identity (1) Jul 24 15:27:10.226525 osdx hostapd[1068767]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:27:10.226530 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'testing' Jul 24 15:27:10.226589 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.226600 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.226801 osdx hostapd[1068767]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:27:10.226808 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.226812 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.226837 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=146 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:27:10.226844 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 146) Jul 24 15:27:10.227659 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=146 len=6) from STA: EAP Response-unknown (3) Jul 24 15:27:10.227759 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.227778 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.228007 osdx hostapd[1068767]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:27:10.228012 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.228015 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.228034 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=147 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.228040 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 147) Jul 24 15:27:10.228431 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=147 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.228490 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.228505 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.229736 osdx hostapd[1068767]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:27:10.229743 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.229748 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.229773 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=148 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.229781 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 148) Jul 24 15:27:10.230001 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=148 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.230047 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.230061 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.230209 osdx hostapd[1068767]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:27:10.230214 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.230218 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.230240 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=149 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.230247 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 149) Jul 24 15:27:10.232192 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=149 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.232247 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.232262 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.232545 osdx hostapd[1068767]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:27:10.232549 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.232552 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.232569 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=150 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.232575 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 150) Jul 24 15:27:10.232808 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=150 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.232851 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.232864 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.232997 osdx hostapd[1068767]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:27:10.233002 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.233004 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.233017 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=151 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.233022 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 151) Jul 24 15:27:10.233167 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=151 len=43) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.233196 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.233206 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.233363 osdx hostapd[1068767]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:27:10.233369 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.233373 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.233387 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=152 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.233392 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 152) Jul 24 15:27:10.233619 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=152 len=97) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.233652 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.233666 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.233857 osdx hostapd[1068767]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 15:27:10.233862 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.233865 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.233876 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=153 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.233881 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 153) Jul 24 15:27:10.234076 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=153 len=37) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.234112 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.234123 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.234267 osdx hostapd[1068767]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:27:10.234271 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.234274 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.234285 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=154 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:10.234290 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 154) Jul 24 15:27:10.234438 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=154 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:27:10.234469 osdx hostapd[1068767]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:10.234482 osdx hostapd[1068767]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:10.234636 osdx hostapd[1068767]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 15:27:10.234641 osdx hostapd[1068767]: eth1: RADIUS Received RADIUS message Jul 24 15:27:10.234644 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:10.234664 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 15:27:10.234668 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=3 id=154 len=4) from RADIUS server: EAP Success Jul 24 15:27:10.234681 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 154) Jul 24 15:27:10.234694 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authorizing port Jul 24 15:27:10.234697 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 RADIUS: starting accounting session F737EB977FD4B044 Jul 24 15:27:10.234708 osdx hostapd[1068767]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful MAB Authentication With Unsuccessful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses an incorrect MAC address and incorrect 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/wKig3mRQKEDJ+wdy/c0soZ6mE3gTLhOZYEbwPPKEqzKgpD5K77p2pvyRk4Rm+ctY4/KvSrGObPg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.344 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.344/0.344/0.344/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/HGLiiDji6McT+4wHctpYz2BIqGt1TiTk= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 9 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 6: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
Jul 24 15:27:19.731095 osdx hostapd[1069346]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:27:19.731558 osdx hostapd[1069346]: connect[radius]: Network is unreachable Jul 24 15:27:19.731117 osdx hostapd[1069346]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:19.731170 osdx hostapd[1069346]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:27:19.731174 osdx hostapd[1069346]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:27:19.751407 osdx hostapd[1069346]: Discovery mode enabled on eth1 Jul 24 15:27:19.751407 osdx hostapd[1069346]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:27:19.751407 osdx hostapd[1069346]: eth1: AP-ENABLED Jul 24 15:27:23.211037 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:27:23.211051 osdx hostapd[1069347]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:27:23.226830 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:27:23.226854 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:27:23.226869 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Jul 24 15:27:23.228714 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Jul 24 15:27:23.228739 osdx hostapd[1069347]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:23.228893 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:23.228946 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:23.228996 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:27:24.229023 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Jul 24 15:27:24.229054 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:27:24.229356 osdx hostapd[1069347]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:27:24.229360 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.229363 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.229367 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:27:24.229417 osdx hostapd[1069347]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:27:24.229419 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Jul 24 15:27:24.229422 osdx hostapd[1069347]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:27:24.229424 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Jul 24 15:27:24.229431 osdx hostapd[1069347]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:27:24.229437 osdx hostapd[1069347]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:27:24.229445 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 203) Jul 24 15:27:24.229756 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=203 len=10) from STA: EAP Response-Identity (1) Jul 24 15:27:24.229765 osdx hostapd[1069347]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:27:24.229769 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'wrong' Jul 24 15:27:24.229830 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.229845 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.230097 osdx hostapd[1069347]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:27:24.230104 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.230107 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.230134 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=204 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:27:24.230141 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 204) Jul 24 15:27:24.230393 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=204 len=6) from STA: EAP Response-unknown (3) Jul 24 15:27:24.230444 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.230457 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.230714 osdx hostapd[1069347]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:27:24.230721 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.230726 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.230749 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=205 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.230757 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 205) Jul 24 15:27:24.231168 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=205 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.231218 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.231233 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.232233 osdx hostapd[1069347]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:27:24.232240 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.232244 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.232266 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=206 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.232273 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 206) Jul 24 15:27:24.232476 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=206 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.232517 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.232529 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.232670 osdx hostapd[1069347]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:27:24.232675 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.232677 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.232691 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=207 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.232695 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 207) Jul 24 15:27:24.234168 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=207 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.234224 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.234237 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.234529 osdx hostapd[1069347]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:27:24.234534 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.234537 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.234551 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=208 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.234557 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 208) Jul 24 15:27:24.234787 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=208 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.234830 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.234845 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.235011 osdx hostapd[1069347]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:27:24.235018 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.235022 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.235048 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=209 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.235057 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 209) Jul 24 15:27:24.235279 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=209 len=41) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.235332 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.235349 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.235516 osdx hostapd[1069347]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:27:24.235522 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.235526 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.235543 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=210 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.235550 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 210) Jul 24 15:27:24.235802 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=210 len=95) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.235841 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.235854 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:24.236034 osdx hostapd[1069347]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:27:24.236043 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:24.236048 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:24.236064 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=211 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:27:24.236070 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 211) Jul 24 15:27:24.236250 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=211 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:27:24.236289 osdx hostapd[1069347]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:24.236300 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:25.236404 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=8) Jul 24 15:27:25.236438 osdx hostapd[1069347]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:27:25.236632 osdx hostapd[1069347]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:27:25.236635 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:25.236639 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:25.236679 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=4 id=211 len=4) from RADIUS server: EAP Failure Jul 24 15:27:25.236706 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 211) Jul 24 15:27:25.236722 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Jul 24 15:27:25.236727 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Jul 24 15:27:25.236730 osdx hostapd[1069347]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) Jul 24 15:27:25.236735 osdx hostapd[1069347]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:27:25.236738 osdx hostapd[1069347]: eth1: RADIUS Received RADIUS message Jul 24 15:27:25.236741 osdx hostapd[1069347]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsuccessful MAB Authentication With Unsupported 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+EaoC88skbvXjQtFBqzLq+ctmEo62TbnRiU/8+bcVJBxX082vSFDsF4bbCTgGiUQz/uuXBCLU9gQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.518 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.518/0.518/0.518/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 5: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: EAP authentication timeoutShow output
Jul 24 15:27:33.886408 osdx hostapd[1069917]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:27:33.886420 osdx hostapd[1069917]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:33.886670 osdx hostapd[1069917]: connect[radius]: Network is unreachable Jul 24 15:27:33.886451 osdx hostapd[1069917]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 15:27:33.886454 osdx hostapd[1069917]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:27:33.914197 osdx hostapd[1069917]: Discovery mode enabled on eth1 Jul 24 15:27:33.914275 osdx hostapd[1069917]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:27:33.914275 osdx hostapd[1069917]: eth1: AP-ENABLED Jul 24 15:27:38.914700 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 DRIVER: Device discovered, triggering MAB authentication Jul 24 15:27:38.914755 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Jul 24 15:27:38.914765 osdx hostapd[1069918]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:27:38.934238 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 15:27:38.934268 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 15:27:38.934283 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Jul 24 15:27:38.936003 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Jul 24 15:27:38.936012 osdx hostapd[1069918]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:27:38.936079 osdx hostapd[1069918]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:27:38.936106 osdx hostapd[1069918]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:27:39.936191 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Jul 24 15:27:39.936229 osdx hostapd[1069918]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:27:39.936368 osdx hostapd[1069918]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:27:39.936371 osdx hostapd[1069918]: eth1: RADIUS Received RADIUS message Jul 24 15:27:39.936380 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:27:39.936384 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 15:27:39.936428 osdx hostapd[1069918]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 15:27:39.936431 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Jul 24 15:27:39.936435 osdx hostapd[1069918]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:27:39.936437 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Jul 24 15:27:39.936442 osdx hostapd[1069918]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:27:39.936449 osdx hostapd[1069918]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:27:39.936458 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 79) Jul 24 15:27:39.936471 osdx hostapd[1069918]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 15:27:39.936474 osdx hostapd[1069918]: eth1: RADIUS Received RADIUS message Jul 24 15:27:39.936476 osdx hostapd[1069918]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet Jul 24 15:27:42.938038 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 79) Jul 24 15:27:48.018033 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 15:27:48.943041 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 79) Jul 24 15:27:56.216148 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 15:28:00.954049 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: aborting authentication Jul 24 15:28:00.954060 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying Jul 24 15:28:00.954072 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 MLME: MLME-DEAUTHENTICATE.indication(00:11:22:33:44:55, 2) Jul 24 15:28:00.954074 osdx hostapd[1069918]: eth1: STA 00:11:22:33:44:55 MLME: MLME-DELETEKEYS.request(00:11:22:33:44:55)