Network Access Server
This scenario shows different Network Access Server (NAS) configurations: server failover and VRF-aware communication.
Test 802.1X Authentication Against NAS Through a VRF-Aware Interface
Description
This scenario shows how to configure 802.1X authentication. It focuses on Authenticator/NAS communication, when performed via an VRF-aware Ethernet interface.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 vrf WAN set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 local-vrf WAN set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX194qb721kFfHYvYJ+kZUGVpQLkvEYGn9Kwwqhiieta4VNCZOyDwU0uK6I5QpW2pAeF4OpzjW6hq2Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf WAN
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 vrf WAN count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: WAN PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 WAN: 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.358 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.358/0.358/0.358/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1++2fK89dyJb81AJpVOTpFvhYrlXcIN9hA= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.553 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.553/0.553/0.553/0.000 ms
Test MAB Authentication Against NAS Through a VRF-Aware Interface
Description
This scenario shows how to configure MAB authentication. It focuses on Authenticator/NAS communication, when performed via an VRF-aware Ethernet interface.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 vrf WAN set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 local-vrf WAN set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+LffizO9G0kYUpLyebpA97YFxk5Lkm3IAazERvQqz1YWW6ctJRTqNOxmNax3kl3fFvOr+FWL8edg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf WAN
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 vrf WAN count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: WAN PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 WAN: 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.50 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.499/1.499/1.499/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.492 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.492/0.492/0.492/0.000 ms
Test 802.1X Authentication With Server Failover
Description
This scenario shows how to configure 802.1X authentication. The primary Nework Access Server is not reachable, so the secondary one is used instead.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 vrf WAN set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup0 local-vrf WAN set system aaa group radius radgroup0 server MAIN set system aaa group radius radgroup1 local-vrf WAN set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 0 group radius radgroup0 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius MAIN address 10.215.168.2 set system aaa server radius MAIN encrypted-key U2FsdGVkX1+52Jv0ymNEHf78XYA6hrdz3IMpxFH06EjWMQ0GdbfUm28x4HJ8OUfwGqxcCNY1hTr3MLxl2owDng== set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+wMKYakaozZK9LwEvBSNtXjWoxXBlcPehZP/6K685aTXoP16f0i8/0VucbrQD67gOHCU2dxq0KPw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf WAN
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 vrf WAN count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: WAN PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 WAN: 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.482 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.482/0.482/0.482/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX19lR66OwgUeswaQdcFFdr/+Zwjd0RmPbgs= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.416 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.416/0.416/0.416/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
No response from Authentication server 10.215.168.2Show output
Jul 24 16:00:14.356969 osdx hostapd[1113065]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:00:14.356993 osdx hostapd[1113065]: eth1: RADIUS Authentication server 10.215.168.2:1812 Jul 24 16:00:14.357297 osdx hostapd[1113065]: connect[radius]: No route to host Jul 24 16:00:14.357045 osdx hostapd[1113065]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Jul 24 16:00:14.357049 osdx hostapd[1113065]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:00:14.372616 osdx hostapd[1113065]: Discovery mode enabled on eth1 Jul 24 16:00:14.372727 osdx hostapd[1113065]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:00:14.372727 osdx hostapd[1113065]: eth1: AP-ENABLED Jul 24 16:00:18.040943 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:00:18.040959 osdx hostapd[1113066]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:00:18.056705 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 16:00:18.056741 osdx hostapd[1113066]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 16:00:18.056762 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 16:00:18.056774 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 16:00:18.056783 osdx hostapd[1113066]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:00:18.056801 osdx hostapd[1113066]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:00:18.056820 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 100) Jul 24 16:00:18.057295 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=100 len=12) from STA: EAP Response-Identity (1) Jul 24 16:00:18.057308 osdx hostapd[1113066]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 16:00:18.057313 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Jul 24 16:00:18.057345 osdx hostapd[1113066]: eth1: RADIUS Authentication server 10.215.168.2:1812 Jul 24 16:00:18.059812 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:18.059861 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:19.059965 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=0) Jul 24 16:00:19.060018 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 16:00:21.060114 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=0) Jul 24 16:00:21.060147 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 4 seconds Jul 24 16:00:25.060423 osdx hostapd[1113066]: eth1: RADIUS No response from Authentication server 10.215.168.2:1812 - failover (1º round) Jul 24 16:00:25.060443 osdx hostapd[1113066]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:00:25.060498 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=0) Jul 24 16:00:25.060536 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 16:00:25.060877 osdx hostapd[1113066]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 16:00:25.060884 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.060889 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.060942 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=101 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 16:00:25.060952 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 101) Jul 24 16:00:25.061387 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=101 len=6) from STA: EAP Response-unknown (3) Jul 24 16:00:25.061449 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.061463 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.061716 osdx hostapd[1113066]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 16:00:25.061724 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.061728 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.061747 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=102 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.061754 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 102) Jul 24 16:00:25.062153 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=102 len=194) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.062199 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.062212 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.063325 osdx hostapd[1113066]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 16:00:25.063333 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.063337 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.063364 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=103 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.063371 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 103) Jul 24 16:00:25.063653 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=103 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.063698 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.063743 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.063856 osdx hostapd[1113066]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 16:00:25.063866 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.063870 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.063886 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=104 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.063893 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 104) Jul 24 16:00:25.066003 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=104 len=103) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.066066 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.066126 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.066466 osdx hostapd[1113066]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 16:00:25.066473 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.066478 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.066512 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=105 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.066521 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 105) Jul 24 16:00:25.066940 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=105 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.066995 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.067045 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.067166 osdx hostapd[1113066]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 16:00:25.067170 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.067174 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.067193 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=106 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.067200 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 106) Jul 24 16:00:25.067467 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=106 len=43) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.067515 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.067557 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.067721 osdx hostapd[1113066]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 16:00:25.067725 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.067729 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.067750 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=107 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.067757 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 107) Jul 24 16:00:25.068377 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=107 len=97) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.068428 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.068476 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.068697 osdx hostapd[1113066]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 16:00:25.068705 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.068709 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.068735 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=108 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.068742 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 108) Jul 24 16:00:25.069051 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=108 len=37) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.069102 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.069118 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.069299 osdx hostapd[1113066]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 16:00:25.069306 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.069311 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.069331 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=109 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:00:25.069338 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 109) Jul 24 16:00:25.069649 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=109 len=46) from STA: EAP Response-PEAP (25) Jul 24 16:00:25.069702 osdx hostapd[1113066]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:25.069721 osdx hostapd[1113066]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:25.069983 osdx hostapd[1113066]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 16:00:25.069991 osdx hostapd[1113066]: eth1: RADIUS Received RADIUS message Jul 24 16:00:25.069995 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:25.070025 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 16:00:25.070029 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=109 len=4) from RADIUS server: EAP Success Jul 24 16:00:25.070047 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 109) Jul 24 16:00:25.070065 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:00:25.070069 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 268A97BA27B2596D Jul 24 16:00:25.070073 osdx hostapd[1113066]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test MAB Authentication With Server Failover
Description
This scenario shows how to configure MAB authentication. The primary Nework Access Server is not reachable, so the secondary one is used instead.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth0 vrf WAN set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup0 local-vrf WAN set system aaa group radius radgroup0 server MAIN set system aaa group radius radgroup1 local-vrf WAN set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 0 group radius radgroup0 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius MAIN address 10.215.168.2 set system aaa server radius MAIN encrypted-key U2FsdGVkX1+dMpEH+9DiIVjzcf/RkwbUE5edPKjX5m39l1u23v7Sly4rvhxyTSumDp1EgKxAOuPVzWCK2gb1/Q== set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18CFzIBzVFDO82SPA3fp0Pil2NHlxhb5jUNxsoLEv/C5NDHtpFUTIwWSg3sAKzNTiA4dS0DA3WZhg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0' set system vrf WAN
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 vrf WAN count 1 size 56 timeout 1Show output
ping: Warning: source address might be selected on device other than: WAN PING 10.215.168.1 (10.215.168.1) from 10.215.168.64 WAN: 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.08 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.076/1.076/1.076/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.370 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.370/0.370/0.370/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
No response from Authentication server 10.215.168.2Show output
Jul 24 16:00:36.245823 osdx hostapd[1113771]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:00:36.245833 osdx hostapd[1113771]: eth1: RADIUS Authentication server 10.215.168.2:1812 Jul 24 16:00:36.246086 osdx hostapd[1113771]: connect[radius]: No route to host Jul 24 16:00:36.245872 osdx hostapd[1113771]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-only, eap_server=0, eap_quiet_period=60, eap_max_retrans=5 Jul 24 16:00:36.245875 osdx hostapd[1113771]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:00:36.273592 osdx hostapd[1113771]: Discovery mode enabled on eth1 Jul 24 16:00:36.273703 osdx hostapd[1113771]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:00:36.273703 osdx hostapd[1113771]: eth1: AP-ENABLED Jul 24 16:00:41.274021 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 16:00:41.274059 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:00:41.274066 osdx hostapd[1113772]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:00:41.293636 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-only mode: Starting MAB authentication Jul 24 16:00:41.293664 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:00:41.293680 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:00:41.295411 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:00:41.295425 osdx hostapd[1113772]: eth1: RADIUS Authentication server 10.215.168.2:1812 Jul 24 16:00:41.295492 osdx hostapd[1113772]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:00:41.295527 osdx hostapd[1113772]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:00:42.295616 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=128) Jul 24 16:00:42.295646 osdx hostapd[1113772]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 16:00:44.296391 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=128) Jul 24 16:00:44.296418 osdx hostapd[1113772]: eth1: RADIUS Next RADIUS client retransmit in 4 seconds Jul 24 16:00:48.297392 osdx hostapd[1113772]: eth1: RADIUS No response from Authentication server 10.215.168.2:1812 - failover (1º round) Jul 24 16:00:48.297408 osdx hostapd[1113772]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:00:48.297449 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=128) Jul 24 16:00:48.297477 osdx hostapd[1113772]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Jul 24 16:00:48.297792 osdx hostapd[1113772]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:00:48.297796 osdx hostapd[1113772]: eth1: RADIUS Received RADIUS message Jul 24 16:00:48.297800 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:00:48.297805 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:00:48.297837 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 16:00:48.297857 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:00:48.297860 osdx hostapd[1113772]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:00:48.297869 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:00:48.297872 osdx hostapd[1113772]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 726C06E38985E29D