Only 802.1X
This scenario shows how to configure the only-802.1x
authentication mode.
Test Successful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18xvT+iPLz/Gl+4PNCj0kwqbk5Djh0sFHZL1k29wt3O7B2flEu6tWNLlVeQ5xqpb9KpAW3jss42oA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.348 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.348/0.348/0.348/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX18xwS9mFKQ/RbxRqBiF6z0a8lwRUy5OOs0= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.460 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.460/0.460/0.460/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Jul 24 15:25:16.726810 osdx hostapd[1065281]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:25:16.727160 osdx hostapd[1065281]: connect[radius]: Network is unreachable Jul 24 15:25:16.726830 osdx hostapd[1065281]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:25:16.726877 osdx hostapd[1065281]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Jul 24 15:25:16.726882 osdx hostapd[1065281]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:25:16.754580 osdx hostapd[1065281]: Discovery mode enabled on eth1 Jul 24 15:25:16.754694 osdx hostapd[1065281]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:25:16.754694 osdx hostapd[1065281]: eth1: AP-ENABLED Jul 24 15:25:20.489892 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:25:20.489907 osdx hostapd[1065282]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:25:20.502635 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:25:20.502674 osdx hostapd[1065282]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:25:20.502692 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:25:20.502707 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:25:20.502716 osdx hostapd[1065282]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:25:20.502733 osdx hostapd[1065282]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:25:20.502750 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 81) Jul 24 15:25:20.503152 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=81 len=12) from STA: EAP Response-Identity (1) Jul 24 15:25:20.503165 osdx hostapd[1065282]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:25:20.503170 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Jul 24 15:25:20.503203 osdx hostapd[1065282]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:25:20.505683 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.505720 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.506033 osdx hostapd[1065282]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:25:20.506040 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.506045 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.506069 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=82 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:25:20.506077 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 82) Jul 24 15:25:20.506383 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=82 len=6) from STA: EAP Response-unknown (3) Jul 24 15:25:20.506446 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.506463 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.506694 osdx hostapd[1065282]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:25:20.506701 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.506705 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.506723 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=83 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.506730 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 83) Jul 24 15:25:20.507160 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=83 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.507211 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.507230 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.508088 osdx hostapd[1065282]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:25:20.508094 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.508097 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.508115 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=84 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.508121 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 84) Jul 24 15:25:20.508324 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=84 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.508367 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.508379 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.508534 osdx hostapd[1065282]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:25:20.508541 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.508544 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.508559 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=85 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.508564 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 85) Jul 24 15:25:20.509988 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=85 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.510064 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.510084 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.510427 osdx hostapd[1065282]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:25:20.510434 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.510438 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.510461 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=86 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.510467 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 86) Jul 24 15:25:20.510748 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=86 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.510796 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.510812 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.510971 osdx hostapd[1065282]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:25:20.510980 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.510985 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.511010 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=87 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.511019 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 87) Jul 24 15:25:20.511214 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=87 len=43) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.511258 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.511272 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.511411 osdx hostapd[1065282]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:25:20.511416 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.511420 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.511434 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=88 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.511440 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 88) Jul 24 15:25:20.511721 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=88 len=97) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.511758 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.511769 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.511931 osdx hostapd[1065282]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 15:25:20.511937 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.511942 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.511958 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=89 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.511964 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 89) Jul 24 15:25:20.512204 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=89 len=37) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.512262 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.512277 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.512445 osdx hostapd[1065282]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:25:20.512450 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.512453 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.512467 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=90 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:20.512473 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 90) Jul 24 15:25:20.512686 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=90 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:25:20.512740 osdx hostapd[1065282]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:20.512756 osdx hostapd[1065282]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:20.512936 osdx hostapd[1065282]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 15:25:20.512943 osdx hostapd[1065282]: eth1: RADIUS Received RADIUS message Jul 24 15:25:20.512947 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:20.512975 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 15:25:20.512979 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=90 len=4) from RADIUS server: EAP Success Jul 24 15:25:20.512998 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 90) Jul 24 15:25:20.513015 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 15:25:20.513019 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 0D9B9DD6529B9573 Jul 24 15:25:20.513024 osdx hostapd[1065282]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19EHJwbqf3lQoCz/zQ6O4UY38XAYhAVDQRz7dDMuBtRbFcLB/Zu8LohJpDNR/aBY9ar7ONVfVfvsA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.20 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.203/1.203/1.203/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX18ftXHORrulJxCr0qMaXf8zuZdW7F9L9/c= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 0 EAPoL Frames (Tx) 0 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 0 Req ID Frames (Rx) 0 Resp Frames (Tx) 0 Start Frames (Tx) 0
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 7: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 8: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 9: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
Jul 24 15:25:28.928667 osdx hostapd[1065859]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:25:28.928682 osdx hostapd[1065859]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:25:28.928956 osdx hostapd[1065859]: connect[radius]: Network is unreachable Jul 24 15:25:28.928717 osdx hostapd[1065859]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Jul 24 15:25:28.928720 osdx hostapd[1065859]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:25:28.952509 osdx hostapd[1065859]: Discovery mode enabled on eth1 Jul 24 15:25:28.952594 osdx hostapd[1065859]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:25:28.952594 osdx hostapd[1065859]: eth1: AP-ENABLED Jul 24 15:25:32.497735 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:25:32.497752 osdx hostapd[1065860]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:25:32.516602 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:25:32.516641 osdx hostapd[1065860]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:25:32.516667 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 15:25:32.516678 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:25:32.516687 osdx hostapd[1065860]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:25:32.516704 osdx hostapd[1065860]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:25:32.516715 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 180) Jul 24 15:25:32.517462 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=180 len=10) from STA: EAP Response-Identity (1) Jul 24 15:25:32.517477 osdx hostapd[1065860]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 15:25:32.517483 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'wrong' Jul 24 15:25:32.517516 osdx hostapd[1065860]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:25:32.519922 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.520238 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.520415 osdx hostapd[1065860]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 15:25:32.520438 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.520443 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.520472 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=181 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 15:25:32.520481 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 181) Jul 24 15:25:32.520885 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=181 len=6) from STA: EAP Response-unknown (3) Jul 24 15:25:32.520946 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.521207 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.521454 osdx hostapd[1065860]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 15:25:32.521461 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.521466 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.521489 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=182 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.521497 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 182) Jul 24 15:25:32.522014 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=182 len=194) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.522066 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.522172 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.523278 osdx hostapd[1065860]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 15:25:32.523287 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.523292 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.523321 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=183 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.523329 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 183) Jul 24 15:25:32.523688 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=183 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.523740 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.523938 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.524157 osdx hostapd[1065860]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 15:25:32.524164 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.524168 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.524190 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=184 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.524197 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 184) Jul 24 15:25:32.527430 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=184 len=103) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.527570 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.527656 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.528235 osdx hostapd[1065860]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 15:25:32.528242 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.528247 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.528272 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=185 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.528281 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 185) Jul 24 15:25:32.528688 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=185 len=6) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.528735 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.528787 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.529575 osdx hostapd[1065860]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 15:25:32.529585 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.529589 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.529619 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=186 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.529627 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 186) Jul 24 15:25:32.529906 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=186 len=41) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.529952 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.529965 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.530201 osdx hostapd[1065860]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 15:25:32.530206 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.530211 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.530231 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=187 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.530238 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 187) Jul 24 15:25:32.530599 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=187 len=95) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.530638 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.530670 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:32.530890 osdx hostapd[1065860]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 15:25:32.530900 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:32.530905 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:32.530929 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=188 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 15:25:32.530937 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 188) Jul 24 15:25:32.531181 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=188 len=46) from STA: EAP Response-PEAP (25) Jul 24 15:25:32.531237 osdx hostapd[1065860]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 15:25:32.531252 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 15:25:33.531358 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=8) Jul 24 15:25:33.531400 osdx hostapd[1065860]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 15:25:33.531808 osdx hostapd[1065860]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:25:33.531813 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:33.531818 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 15:25:33.531876 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=4 id=188 len=4) from RADIUS server: EAP Failure Jul 24 15:25:33.531903 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 188) Jul 24 15:25:33.531922 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:25:33.531926 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Jul 24 15:25:33.531929 osdx hostapd[1065860]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) Jul 24 15:25:33.531935 osdx hostapd[1065860]: eth1: RADIUS Received 44 bytes from RADIUS server Jul 24 15:25:33.531937 osdx hostapd[1065860]: eth1: RADIUS Received RADIUS message Jul 24 15:25:33.531940 osdx hostapd[1065860]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsupported 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+pb23E9mR0RDkuKyHcjxaxc12eNTKj1ZebjYYoRYz2jeEIhXhFm1UN7yDJLZ402fV0wukXxz55Dg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.705 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.705/0.705/0.705/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP authentication timeoutShow output
Jul 24 15:25:44.470483 osdx hostapd[1066435]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 15:25:44.470494 osdx hostapd[1066435]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 15:25:44.470741 osdx hostapd[1066435]: connect[radius]: Network is unreachable Jul 24 15:25:44.470525 osdx hostapd[1066435]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Jul 24 15:25:44.470528 osdx hostapd[1066435]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 15:25:44.490260 osdx hostapd[1066435]: Discovery mode enabled on eth1 Jul 24 15:25:44.490354 osdx hostapd[1066435]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 15:25:44.490354 osdx hostapd[1066435]: eth1: AP-ENABLED Jul 24 15:25:49.490476 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 15:25:49.490521 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 15:25:49.490534 osdx hostapd[1066436]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 15:25:49.514315 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 15:25:49.514341 osdx hostapd[1066436]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 15:25:49.514356 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 15:25:49.514363 osdx hostapd[1066436]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 15:25:49.514381 osdx hostapd[1066436]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 15:25:49.514396 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 97) Jul 24 15:25:52.517097 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 97) Jul 24 15:25:57.630844 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 15:25:58.522135 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 97) Jul 24 15:26:05.961759 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 15:26:10.532135 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication Jul 24 15:26:10.532160 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying Jul 24 15:26:10.532174 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 MLME: MLME-DEAUTHENTICATE.indication(de:ad:be:ef:6c:11, 2) Jul 24 15:26:10.532177 osdx hostapd[1066436]: eth1: STA de:ad:be:ef:6c:11 MLME: MLME-DELETEKEYS.request(de:ad:be:ef:6c:11)