Reauth Period
This scenario shows how to configure the reauthentication period in a device with 802.1x/MAB authentication.
Test Reauth Period In 802.1X Mode
Description
This scenario shows how to configure the reauthentication period in a device with 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 20 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/bURkfgBrJK/YvjCZvCVgPKDjH7hE9xRlKArWELqMzXzTYEau5rCWKHuGWwhuaQxLxO59Nm/uWuw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.285 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.285/0.285/0.285/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/maHaon83NIzXYz48iQ5/L4SgZKLzRAuw= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticatedShow output
Jul 24 16:01:00.892274 osdx hostapd[1114461]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:01:00.892296 osdx hostapd[1114461]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:01:00.892546 osdx hostapd[1114461]: connect[radius]: Network is unreachable Jul 24 16:01:00.892343 osdx hostapd[1114461]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Jul 24 16:01:00.892347 osdx hostapd[1114461]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:01:00.908002 osdx hostapd[1114461]: Discovery mode enabled on eth1 Jul 24 16:01:00.908003 osdx hostapd[1114461]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames Jul 24 16:01:00.908116 osdx hostapd[1114461]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:01:00.908116 osdx hostapd[1114461]: eth1: AP-ENABLED Jul 24 16:01:03.472154 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:05.157229 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:01:05.157249 osdx hostapd[1114462]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:01:05.172030 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 16:01:05.172068 osdx hostapd[1114462]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 16:01:05.172090 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Jul 24 16:01:05.172100 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 16:01:05.172111 osdx hostapd[1114462]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:01:05.172127 osdx hostapd[1114462]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:01:05.172138 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 157) Jul 24 16:01:05.172452 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=157 len=12) from STA: EAP Response-Identity (1) Jul 24 16:01:05.172463 osdx hostapd[1114462]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 16:01:05.172467 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Jul 24 16:01:05.172498 osdx hostapd[1114462]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:01:05.174961 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.174994 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.175221 osdx hostapd[1114462]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 16:01:05.175228 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.175232 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.175255 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=158 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 16:01:05.175263 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 158) Jul 24 16:01:05.175441 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=158 len=6) from STA: EAP Response-unknown (3) Jul 24 16:01:05.175488 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.175502 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.175630 osdx hostapd[1114462]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 16:01:05.175636 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.175640 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.175654 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=159 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.175660 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 159) Jul 24 16:01:05.176059 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=159 len=194) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.176111 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.176126 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.176971 osdx hostapd[1114462]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 16:01:05.176977 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.176981 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.177005 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=160 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.177011 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 160) Jul 24 16:01:05.177168 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=160 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.177209 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.177221 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.177326 osdx hostapd[1114462]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 16:01:05.177331 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.177334 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.177348 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=161 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.177355 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 161) Jul 24 16:01:05.178674 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=161 len=103) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.178722 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.178737 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.179006 osdx hostapd[1114462]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 16:01:05.179013 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.179016 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.179034 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=162 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.179040 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 162) Jul 24 16:01:05.179298 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=162 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.179342 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.179355 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.179486 osdx hostapd[1114462]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 16:01:05.179491 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.179494 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.179509 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=163 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.179515 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 163) Jul 24 16:01:05.179700 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=163 len=43) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.179755 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.179771 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.179907 osdx hostapd[1114462]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 16:01:05.179913 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.179917 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.179943 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=164 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.179949 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 164) Jul 24 16:01:05.180200 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=164 len=97) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.180241 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.180255 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.180411 osdx hostapd[1114462]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 16:01:05.180416 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.180419 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.180434 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=165 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.180439 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 165) Jul 24 16:01:05.180607 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=165 len=37) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.180647 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.180663 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.180787 osdx hostapd[1114462]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 16:01:05.180791 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.180794 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.180807 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=166 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:05.180813 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 166) Jul 24 16:01:05.180992 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=166 len=46) from STA: EAP Response-PEAP (25) Jul 24 16:01:05.181028 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:05.181039 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:05.181202 osdx hostapd[1114462]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 16:01:05.181207 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:05.181210 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:05.181226 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 16:01:05.181230 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=166 len=4) from RADIUS server: EAP Success Jul 24 16:01:05.181244 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 166) Jul 24 16:01:05.181256 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:01:05.181260 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session EDF5A1E605162A05 Jul 24 16:01:05.181264 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: Re-authentication period expiredShow output
Jul 24 16:01:05.816236 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:07.937152 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:10.066434 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:12.204807 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:14.313191 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:16.408125 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:18.529681 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:20.632903 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:22.761950 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:25.073517 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:25.189803 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication Jul 24 16:01:25.189817 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Starting re-authentication (port will be unauthorized until authentication succeeds) Jul 24 16:01:25.189822 osdx hostapd[1114462]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:01:25.189857 osdx hostapd[1114462]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:01:25.189870 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 158) Jul 24 16:01:25.190355 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=158 len=12) from STA: EAP Response-Identity (1) Jul 24 16:01:25.190371 osdx hostapd[1114462]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Jul 24 16:01:25.190376 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Jul 24 16:01:25.190455 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.190490 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.190745 osdx hostapd[1114462]: eth1: RADIUS Received 80 bytes from RADIUS server Jul 24 16:01:25.190752 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.190756 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.190777 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=159 len=22) from RADIUS server: EAP-Request-MD5 (4) Jul 24 16:01:25.190784 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 159) Jul 24 16:01:25.190980 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=159 len=6) from STA: EAP Response-unknown (3) Jul 24 16:01:25.191032 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.191049 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.191205 osdx hostapd[1114462]: eth1: RADIUS Received 64 bytes from RADIUS server Jul 24 16:01:25.191209 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.191212 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.191226 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=160 len=6) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.191232 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 160) Jul 24 16:01:25.191558 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=160 len=194) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.191593 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.191605 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.192448 osdx hostapd[1114462]: eth1: RADIUS Received 1068 bytes from RADIUS server Jul 24 16:01:25.192454 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.192457 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.192481 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=161 len=1004) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.192488 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 161) Jul 24 16:01:25.192665 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=161 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.192707 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.192720 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.192828 osdx hostapd[1114462]: eth1: RADIUS Received 229 bytes from RADIUS server Jul 24 16:01:25.192833 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.192836 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.192850 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=162 len=171) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.192855 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 162) Jul 24 16:01:25.193928 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=162 len=103) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.193980 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.193994 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.194256 osdx hostapd[1114462]: eth1: RADIUS Received 115 bytes from RADIUS server Jul 24 16:01:25.194262 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.194266 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.194286 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=163 len=57) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.194292 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 163) Jul 24 16:01:25.194525 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=163 len=6) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.194569 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.194580 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.194709 osdx hostapd[1114462]: eth1: RADIUS Received 98 bytes from RADIUS server Jul 24 16:01:25.194715 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.194719 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.194742 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=164 len=40) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.194748 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 164) Jul 24 16:01:25.194907 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=164 len=43) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.194945 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.194956 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.195084 osdx hostapd[1114462]: eth1: RADIUS Received 131 bytes from RADIUS server Jul 24 16:01:25.195090 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.195094 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.195110 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=165 len=73) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.195117 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 165) Jul 24 16:01:25.195392 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=165 len=97) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.195449 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.195464 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.195666 osdx hostapd[1114462]: eth1: RADIUS Received 140 bytes from RADIUS server Jul 24 16:01:25.195671 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.195674 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.195689 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=166 len=82) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.195695 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 166) Jul 24 16:01:25.195900 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=166 len=37) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.195956 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.195968 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.196096 osdx hostapd[1114462]: eth1: RADIUS Received 104 bytes from RADIUS server Jul 24 16:01:25.196103 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.196107 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.196123 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=167 len=46) from RADIUS server: EAP-Request-PEAP (25) Jul 24 16:01:25.196128 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 167) Jul 24 16:01:25.196307 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=167 len=46) from STA: EAP Response-PEAP (25) Jul 24 16:01:25.196347 osdx hostapd[1114462]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:25.196391 osdx hostapd[1114462]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:25.196532 osdx hostapd[1114462]: eth1: RADIUS Received 175 bytes from RADIUS server Jul 24 16:01:25.196538 osdx hostapd[1114462]: eth1: RADIUS Received RADIUS message Jul 24 16:01:25.196542 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:25.196565 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Jul 24 16:01:25.196568 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=167 len=4) from RADIUS server: EAP Success Jul 24 16:01:25.196582 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 167) Jul 24 16:01:25.196592 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:01:25.196595 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session EDF5A1E605162A05 Jul 24 16:01:25.196599 osdx hostapd[1114462]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Reauth Period In MAB Mode
Description
This scenario shows how to configure the reauthentication period in a device with MAB authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 20 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/dNqVPboU3J7o9Eo+ceG/vZ1Z8W+YURIlyoAxuycJkV2dJJdmuvada5rZmD7kPaq8BwUhGWhaiHg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.645 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.645/0.645/0.645/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
MAB: station successfully authenticatedShow output
Jul 24 16:01:35.643324 osdx hostapd[1115112]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:01:35.643335 osdx hostapd[1115112]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:01:35.643586 osdx hostapd[1115112]: connect[radius]: Network is unreachable Jul 24 16:01:35.643372 osdx hostapd[1115112]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-only, eap_server=0, eap_quiet_period=60, eap_max_retrans=5 Jul 24 16:01:35.643375 osdx hostapd[1115112]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:01:35.659169 osdx hostapd[1115112]: Discovery mode enabled on eth1 Jul 24 16:01:35.659248 osdx hostapd[1115112]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:01:35.659248 osdx hostapd[1115112]: eth1: AP-ENABLED Jul 24 16:01:39.421878 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:40.662020 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 16:01:40.662063 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:01:40.662072 osdx hostapd[1115113]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:01:40.675237 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-only mode: Starting MAB authentication Jul 24 16:01:40.675264 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:01:40.675283 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:01:40.677407 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:01:40.677423 osdx hostapd[1115113]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:01:40.677515 osdx hostapd[1115113]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:01:40.677551 osdx hostapd[1115113]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:01:40.677870 osdx hostapd[1115113]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:01:40.677877 osdx hostapd[1115113]: eth1: RADIUS Received RADIUS message Jul 24 16:01:40.677882 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:01:40.677887 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:01:40.677902 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 16:01:40.677918 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:01:40.677922 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds) Jul 24 16:01:40.677924 osdx hostapd[1115113]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:01:40.677946 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:01:40.677950 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 37098EF17AE9D8A0
Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: Re-authentication period expiredShow output
Jul 24 16:01:43.881339 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:47.050526 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:50.271994 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:53.484358 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:56.687785 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:01:59.902074 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:00.692989 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication Jul 24 16:02:00.693005 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:02:00.693051 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:02:00.693080 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:02:00.693103 osdx hostapd[1115113]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:02:00.693145 osdx hostapd[1115113]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:02:00.693504 osdx hostapd[1115113]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:02:00.693512 osdx hostapd[1115113]: eth1: RADIUS Received RADIUS message Jul 24 16:02:00.693517 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:02:00.693522 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:02:00.693559 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:02:00.693563 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds) Jul 24 16:02:00.693566 osdx hostapd[1115113]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:02:00.693571 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:02:00.693574 osdx hostapd[1115113]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 37098EF17AE9D8A0
Test Reauth Period In MAB-Fallback Mode
Description
This scenario shows how to configure the reauthentication period in a device with 802.1x/MAB authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 20 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19b1TMvdcuekgtlKCHD298swMNmRPKrNN6On3Ubx1QS40MnDpw+z19I2fSA3CRO89nnwcHqWXd5ZA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.691 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.691/0.691/0.691/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
MAB: station successfully authenticatedShow output
Jul 24 16:02:10.393390 osdx hostapd[1115745]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:02:10.393401 osdx hostapd[1115745]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:02:10.393623 osdx hostapd[1115745]: connect[radius]: Network is unreachable Jul 24 16:02:10.393433 osdx hostapd[1115745]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 16:02:10.393437 osdx hostapd[1115745]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:02:10.413162 osdx hostapd[1115745]: Discovery mode enabled on eth1 Jul 24 16:02:10.413166 osdx hostapd[1115745]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames Jul 24 16:02:10.413266 osdx hostapd[1115745]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:02:10.413266 osdx hostapd[1115745]: eth1: AP-ENABLED Jul 24 16:02:14.042579 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:15.416013 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 16:02:15.416050 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:02:15.416058 osdx hostapd[1115746]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:02:15.429251 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Jul 24 16:02:15.429296 osdx hostapd[1115746]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Jul 24 16:02:15.429302 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 16:02:15.429305 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 16:02:15.429324 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 16:02:15.429334 osdx hostapd[1115746]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:02:15.429354 osdx hostapd[1115746]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:02:15.429370 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 240) Jul 24 16:02:18.230857 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:18.432025 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 240) Jul 24 16:02:22.428450 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:24.437019 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 240) Jul 24 16:02:26.616382 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:30.812132 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:35.081684 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:36.448024 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication Jul 24 16:02:36.448032 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately Jul 24 16:02:36.448036 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:02:36.448071 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:02:36.449820 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:02:36.449835 osdx hostapd[1115746]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:02:36.449907 osdx hostapd[1115746]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:02:36.449943 osdx hostapd[1115746]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:02:36.449963 osdx hostapd[1115746]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:02:36.449973 osdx hostapd[1115746]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:02:36.449985 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 130) Jul 24 16:02:36.450270 osdx hostapd[1115746]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:02:36.450278 osdx hostapd[1115746]: eth1: RADIUS Received RADIUS message Jul 24 16:02:36.450290 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:02:36.450295 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:02:36.450318 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 16:02:36.450333 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:02:36.450337 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds) Jul 24 16:02:36.450340 osdx hostapd[1115746]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:02:36.450350 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:02:36.450354 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 14ECDF6BC8C4E7B1
Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: Re-authentication period expiredShow output
Jul 24 16:02:39.537379 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:42.730735 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:45.905854 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:49.108976 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:52.338881 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:55.552105 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:02:56.468002 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication Jul 24 16:02:56.468022 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback: Scheduling MAB trigger in 30 seconds if no 802.1X response Jul 24 16:02:56.468027 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Jul 24 16:02:56.468060 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Jul 24 16:02:56.468065 osdx hostapd[1115746]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Jul 24 16:02:56.468075 osdx hostapd[1115746]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Jul 24 16:02:56.468092 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 222) Jul 24 16:02:59.471004 osdx hostapd[1115746]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 222)
Test Reauth Period In MAB-First Mode
Description
This scenario shows how to configure the reauthentication period in a device with MAB/802.1X authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 20 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+SCtfUxevL0csbQxIZBXmSVIpCpcbp04iijJgK83qd/whYqL1Iy0tQpXjes7Z7UFNWFVyglgFJuA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.341 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.341/0.341/0.341/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
MAB: station successfully authenticatedShow output
Jul 24 16:03:08.817125 osdx hostapd[1116404]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Jul 24 16:03:08.817146 osdx hostapd[1116404]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:03:08.817468 osdx hostapd[1116404]: connect[radius]: Network is unreachable Jul 24 16:03:08.817202 osdx hostapd[1116404]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Jul 24 16:03:08.817206 osdx hostapd[1116404]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Jul 24 16:03:08.833263 osdx hostapd[1116404]: Discovery mode enabled on eth1 Jul 24 16:03:08.833263 osdx hostapd[1116404]: eth1: interface state UNINITIALIZED->ENABLED Jul 24 16:03:08.833263 osdx hostapd[1116404]: eth1: AP-ENABLED Jul 24 16:03:08.832940 osdx hostapd[1116404]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames Jul 24 16:03:12.634298 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:13.835757 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Jul 24 16:03:13.835801 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Jul 24 16:03:13.835809 osdx hostapd[1116405]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Jul 24 16:03:13.848941 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Jul 24 16:03:13.848969 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:03:13.848983 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:03:13.850678 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:03:13.850689 osdx hostapd[1116405]: eth1: RADIUS Authentication server 10.215.168.1:1812 Jul 24 16:03:13.850755 osdx hostapd[1116405]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:03:13.850783 osdx hostapd[1116405]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:03:13.850831 osdx hostapd[1116405]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Sending EAP-Request/Identity frame Jul 24 16:03:13.850841 osdx hostapd[1116405]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Next EAP-Request/Identity retransmit in 20 seconds Jul 24 16:03:13.851051 osdx hostapd[1116405]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:03:13.851056 osdx hostapd[1116405]: eth1: RADIUS Received RADIUS message Jul 24 16:03:13.851060 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:03:13.851063 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:03:13.851076 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Jul 24 16:03:13.851088 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:03:13.851090 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds) Jul 24 16:03:13.851092 osdx hostapd[1116405]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:03:13.851104 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:03:13.851107 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 137B0DB9D5BA4733
Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: Re-authentication period expiredShow output
Jul 24 16:03:17.119098 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:20.296468 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:23.498237 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:26.708542 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:30.011314 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:33.205898 osdx OSDxCLI[1062781]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Jul 24 16:03:33.851755 osdx hostapd[1116405]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Sending EAP-Request/Identity frame Jul 24 16:03:33.851781 osdx hostapd[1116405]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Next EAP-Request/Identity retransmit in 20 seconds Jul 24 16:03:33.865794 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication Jul 24 16:03:33.865811 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Jul 24 16:03:33.865869 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Jul 24 16:03:33.865909 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Jul 24 16:03:33.865939 osdx hostapd[1116405]: eth1: RADIUS Sending RADIUS message to authentication server Jul 24 16:03:33.865987 osdx hostapd[1116405]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Jul 24 16:03:33.866298 osdx hostapd[1116405]: eth1: RADIUS Received 20 bytes from RADIUS server Jul 24 16:03:33.866305 osdx hostapd[1116405]: eth1: RADIUS Received RADIUS message Jul 24 16:03:33.866309 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Jul 24 16:03:33.866315 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Jul 24 16:03:33.866341 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Jul 24 16:03:33.866345 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds) Jul 24 16:03:33.866348 osdx hostapd[1116405]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Jul 24 16:03:33.866355 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Jul 24 16:03:33.866359 osdx hostapd[1116405]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 137B0DB9D5BA4733