Mab Fallback
This scenario shows how to configure the MAB-fallback
authentication mode.
Test Successful 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/S/gwKMLK0xV2UDSHBvbhPezMIPm/xhP26+oaXqTt4AAAJC58cV00W2EBtAedcEjtOZ1mXYDdR0Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.362 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.362/0.362/0.362/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX19ssy6WA3894q6DeXNLMHG14ELAHnVKyVw= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.362 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.362/0.362/0.362/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Sep 16 14:28:03.525897 osdx hostapd[79733]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:28:03.525908 osdx hostapd[79733]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:03.526191 osdx hostapd[79733]: connect[radius]: Network is unreachable Sep 16 14:28:03.525941 osdx hostapd[79733]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:28:03.525944 osdx hostapd[79733]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:28:03.545773 osdx hostapd[79733]: Discovery mode enabled on eth1 Sep 16 14:28:03.545849 osdx hostapd[79733]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:28:03.545849 osdx hostapd[79733]: eth1: AP-ENABLED Sep 16 14:28:06.902113 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:28:06.902126 osdx hostapd[79734]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:28:06.925870 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:28:06.925909 osdx hostapd[79734]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:28:06.925915 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:28:06.925918 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:28:06.925938 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Sep 16 14:28:06.925942 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:28:06.925952 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:28:06.925966 osdx hostapd[79734]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:28:06.925982 osdx hostapd[79734]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:28:06.925998 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 121) Sep 16 14:28:06.926601 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=121 len=12) from STA: EAP Response-Identity (1) Sep 16 14:28:06.926611 osdx hostapd[79734]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:28:06.926616 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Sep 16 14:28:06.926650 osdx hostapd[79734]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:06.928629 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.928686 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.928957 osdx hostapd[79734]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:28:06.928960 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.928963 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.928989 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=122 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:28:06.928997 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 122) Sep 16 14:28:06.929339 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=122 len=6) from STA: EAP Response-unknown (3) Sep 16 14:28:06.929396 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.929412 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.929623 osdx hostapd[79734]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:28:06.929629 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.929633 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.929654 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=123 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.929661 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 123) Sep 16 14:28:06.930089 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=123 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.930134 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.930147 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.931168 osdx hostapd[79734]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:28:06.931177 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.931182 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.931213 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=124 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.931222 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 124) Sep 16 14:28:06.931467 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=124 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.931528 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.931544 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.931706 osdx hostapd[79734]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:28:06.931712 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.931717 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.931734 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=125 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.931741 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 125) Sep 16 14:28:06.933809 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=125 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.933898 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.933919 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.934261 osdx hostapd[79734]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:28:06.934268 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.934272 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.934295 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=126 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.934304 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 126) Sep 16 14:28:06.934621 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=126 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.934672 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.934690 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.934869 osdx hostapd[79734]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:28:06.934874 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.934877 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.934892 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=127 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.934898 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 127) Sep 16 14:28:06.935088 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=127 len=43) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.935121 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.935132 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.935295 osdx hostapd[79734]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:28:06.935301 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.935304 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.935321 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=128 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.935327 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 128) Sep 16 14:28:06.935663 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=128 len=97) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.935705 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.935715 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.935931 osdx hostapd[79734]: eth1: RADIUS Received 140 bytes from RADIUS server Sep 16 14:28:06.935936 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.935939 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.935954 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=129 len=82) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.935960 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 129) Sep 16 14:28:06.936178 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=129 len=37) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.936214 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.936228 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.936381 osdx hostapd[79734]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:28:06.936386 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.936390 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.936405 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=130 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:06.936411 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 130) Sep 16 14:28:06.936605 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=130 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:28:06.936643 osdx hostapd[79734]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:06.936656 osdx hostapd[79734]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:06.936866 osdx hostapd[79734]: eth1: RADIUS Received 175 bytes from RADIUS server Sep 16 14:28:06.936876 osdx hostapd[79734]: eth1: RADIUS Received RADIUS message Sep 16 14:28:06.936881 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:06.936915 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Sep 16 14:28:06.936919 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=130 len=4) from RADIUS server: EAP Success Sep 16 14:28:06.936942 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 130) Sep 16 14:28:06.936961 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:28:06.936965 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 78B52B898C2A8DA4 Sep 16 14:28:06.936969 osdx hostapd[79734]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Successful 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses the correct username and password, but an incorrect MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/7yR2ieomRGL98DhbkI4YXcdgctHvaH29LqfMycjxOOlPYyCVG7gPsGnPZkRLHdhXaYpOZ+LtpBg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.336 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.336/0.336/0.336/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX19dd7yeNGKQtRFTf25sE/KOxtD9bwLfAas= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.275 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.275/0.275/0.275/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Sep 16 14:28:17.605720 osdx hostapd[80311]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:28:17.605732 osdx hostapd[80311]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:17.606003 osdx hostapd[80311]: connect[radius]: Network is unreachable Sep 16 14:28:17.605768 osdx hostapd[80311]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:28:17.605771 osdx hostapd[80311]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:28:17.629537 osdx hostapd[80311]: Discovery mode enabled on eth1 Sep 16 14:28:17.629631 osdx hostapd[80311]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:28:17.629631 osdx hostapd[80311]: eth1: AP-ENABLED Sep 16 14:28:21.115920 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:28:21.115935 osdx hostapd[80312]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:28:21.133631 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Sep 16 14:28:21.133667 osdx hostapd[80312]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:28:21.133672 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:28:21.133676 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:28:21.133698 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Sep 16 14:28:21.133701 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:28:21.133712 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Sep 16 14:28:21.133726 osdx hostapd[80312]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:28:21.133741 osdx hostapd[80312]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:28:21.133752 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 179) Sep 16 14:28:21.134185 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=179 len=12) from STA: EAP Response-Identity (1) Sep 16 14:28:21.134205 osdx hostapd[80312]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:28:21.134210 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'testing' Sep 16 14:28:21.134237 osdx hostapd[80312]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:21.136436 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.136472 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.136755 osdx hostapd[80312]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:28:21.142237 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.142242 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.142268 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=180 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:28:21.142279 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 180) Sep 16 14:28:21.142742 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=180 len=6) from STA: EAP Response-unknown (3) Sep 16 14:28:21.142797 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.142813 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.143068 osdx hostapd[80312]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:28:21.143074 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.143078 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.143094 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=181 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.143101 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 181) Sep 16 14:28:21.143660 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=181 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.143701 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.143712 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.144878 osdx hostapd[80312]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:28:21.144886 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.144890 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.144909 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=182 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.144916 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 182) Sep 16 14:28:21.145453 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=182 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.145568 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.145587 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.145781 osdx hostapd[80312]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:28:21.145788 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.145792 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.145811 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=183 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.145818 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 183) Sep 16 14:28:21.148523 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=183 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.148574 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.148588 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.148884 osdx hostapd[80312]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:28:21.148891 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.148894 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.148915 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=184 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.148921 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 184) Sep 16 14:28:21.149238 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=184 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.149284 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.149300 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.149476 osdx hostapd[80312]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:28:21.149484 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.149505 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.149533 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=185 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.149541 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 185) Sep 16 14:28:21.149779 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=185 len=43) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.149820 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.149831 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.150006 osdx hostapd[80312]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:28:21.150013 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.150017 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.150037 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=186 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.150043 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 186) Sep 16 14:28:21.150375 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=186 len=97) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.150415 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.150426 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.150660 osdx hostapd[80312]: eth1: RADIUS Received 140 bytes from RADIUS server Sep 16 14:28:21.150666 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.150670 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.150688 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=187 len=82) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.150695 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 187) Sep 16 14:28:21.150918 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=187 len=37) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.150961 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.150974 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.151140 osdx hostapd[80312]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:28:21.151145 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.151149 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.151168 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=188 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:21.151175 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 188) Sep 16 14:28:21.151408 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=188 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:28:21.151455 osdx hostapd[80312]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:21.151466 osdx hostapd[80312]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:21.151690 osdx hostapd[80312]: eth1: RADIUS Received 175 bytes from RADIUS server Sep 16 14:28:21.151697 osdx hostapd[80312]: eth1: RADIUS Received RADIUS message Sep 16 14:28:21.151701 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:21.151730 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Sep 16 14:28:21.151734 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=3 id=188 len=4) from RADIUS server: EAP Success Sep 16 14:28:21.151750 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 188) Sep 16 14:28:21.151766 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authorizing port Sep 16 14:28:21.151769 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 RADIUS: starting accounting session 160B001020EEB0F5 Sep 16 14:28:21.151773 osdx hostapd[80312]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19y8AAvfCpNM0aVUVGbKo18ZgQnhXaC3SeVnTrM8VWtkTX5rxnjvhuJKD1ac5jXn/z0fiyk/jlV9Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.291 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.291/0.291/0.291/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1+LM2f4VwIzNN7UasmiE45QA5PSYws6jxE= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name wrong
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.428 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.428/0.428/0.428/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately 802.1X: MAB: station successfully authenticatedShow output
Sep 16 14:28:30.417313 osdx hostapd[80887]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:28:30.417334 osdx hostapd[80887]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:30.417594 osdx hostapd[80887]: connect[radius]: Network is unreachable Sep 16 14:28:30.417395 osdx hostapd[80887]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:28:30.417399 osdx hostapd[80887]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:28:30.437603 osdx hostapd[80887]: Discovery mode enabled on eth1 Sep 16 14:28:30.437603 osdx hostapd[80887]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:28:30.437603 osdx hostapd[80887]: eth1: AP-ENABLED Sep 16 14:28:33.832393 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:28:33.832406 osdx hostapd[80888]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:28:33.845114 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:28:33.845139 osdx hostapd[80888]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:28:33.845143 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:28:33.845145 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:28:33.845162 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Sep 16 14:28:33.845164 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:28:33.845172 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:28:33.845180 osdx hostapd[80888]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:28:33.845192 osdx hostapd[80888]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:28:33.845204 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 1) Sep 16 14:28:33.845525 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=1 len=10) from STA: EAP Response-Identity (1) Sep 16 14:28:33.845537 osdx hostapd[80888]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:28:33.845541 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'wrong' Sep 16 14:28:33.845569 osdx hostapd[80888]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:33.847431 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.847458 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.847716 osdx hostapd[80888]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:28:33.847721 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.847724 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.847740 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=2 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:28:33.847746 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 2) Sep 16 14:28:33.848032 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=2 len=6) from STA: EAP Response-unknown (3) Sep 16 14:28:33.848102 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.848120 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.848319 osdx hostapd[80888]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:28:33.848326 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.848331 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.848349 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=3 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.848357 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 3) Sep 16 14:28:33.848774 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=3 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.848823 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.848841 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.849968 osdx hostapd[80888]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:28:33.849976 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.849981 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.850012 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=4 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.850021 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 4) Sep 16 14:28:33.850243 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=4 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.850300 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.850315 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.850491 osdx hostapd[80888]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:28:33.850500 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.850504 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.850535 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=5 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.850543 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 5) Sep 16 14:28:33.852464 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=5 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.852519 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.852534 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.852872 osdx hostapd[80888]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:28:33.852883 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.852887 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.852908 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=6 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.852915 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 6) Sep 16 14:28:33.853234 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=6 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.853288 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.853301 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.853456 osdx hostapd[80888]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:28:33.853463 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.853467 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.853486 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=7 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.853493 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 7) Sep 16 14:28:33.853697 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=7 len=41) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.853739 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.853754 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.853913 osdx hostapd[80888]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:28:33.853919 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.853923 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.853937 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=8 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.853946 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 8) Sep 16 14:28:33.854294 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=8 len=95) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.854347 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.854365 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:33.854572 osdx hostapd[80888]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:28:33.854577 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:33.854582 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:33.854599 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=9 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:33.854605 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 9) Sep 16 14:28:33.854832 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=9 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:28:33.854881 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:33.854895 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:34.855055 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=8) Sep 16 14:28:34.855101 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:28:34.855334 osdx hostapd[80888]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:28:34.855340 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:34.855345 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:34.855405 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=4 id=9 len=4) from RADIUS server: EAP Failure Sep 16 14:28:34.855434 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 9) Sep 16 14:28:34.855520 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:28:34.855524 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Sep 16 14:28:34.855528 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately Sep 16 14:28:34.855533 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:28:34.855565 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Sep 16 14:28:34.855574 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Sep 16 14:28:34.855588 osdx hostapd[80888]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:34.855798 osdx hostapd[80888]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:34.855814 osdx hostapd[80888]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:28:34.855817 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:34.855821 osdx hostapd[80888]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet Sep 16 14:28:34.856554 osdx hostapd[80888]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:28:34.856562 osdx hostapd[80888]: eth1: RADIUS Received RADIUS message Sep 16 14:28:34.856566 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:34.856570 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:28:34.856595 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Sep 16 14:28:34.856598 osdx hostapd[80888]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:28:34.856608 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:28:34.856612 osdx hostapd[80888]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 45453B60D50DAE5A
Test Unsuccessful 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 uses an incorrect username and MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/VH6IC1wb7ZfoW+gwOkWDhqtjhpr9NjG5wLkG72BpjQAVv9nAZWygP1ZcUAL7jqLv6pYqIDBZB+Q== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.358 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.358/0.358/0.358/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX19e9zsKs6tBiSsnFClE+dMxvzrcNhB7wLs= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 6: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately 802.1X: MAB: Authentication failedShow output
Sep 16 14:28:44.633224 osdx hostapd[81465]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:28:44.633245 osdx hostapd[81465]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:44.633502 osdx hostapd[81465]: connect[radius]: Network is unreachable Sep 16 14:28:44.633294 osdx hostapd[81465]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:28:44.633298 osdx hostapd[81465]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:28:44.657139 osdx hostapd[81465]: Discovery mode enabled on eth1 Sep 16 14:28:44.657235 osdx hostapd[81465]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:28:44.657235 osdx hostapd[81465]: eth1: AP-ENABLED Sep 16 14:28:48.261374 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:28:48.261388 osdx hostapd[81466]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:28:48.281157 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Sep 16 14:28:48.281191 osdx hostapd[81466]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:28:48.281196 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:28:48.281200 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:28:48.281219 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Cancelled MAB trigger - received 802.1X response Sep 16 14:28:48.281222 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:28:48.281237 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Sep 16 14:28:48.281247 osdx hostapd[81466]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:28:48.281263 osdx hostapd[81466]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:28:48.281277 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 176) Sep 16 14:28:48.281682 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=176 len=10) from STA: EAP Response-Identity (1) Sep 16 14:28:48.281695 osdx hostapd[81466]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:28:48.281699 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'wrong' Sep 16 14:28:48.281733 osdx hostapd[81466]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:48.283556 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.283583 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.283838 osdx hostapd[81466]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:28:48.283845 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.283853 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.283884 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=177 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:28:48.283893 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 177) Sep 16 14:28:48.284141 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=177 len=6) from STA: EAP Response-unknown (3) Sep 16 14:28:48.284192 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.284203 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.284383 osdx hostapd[81466]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:28:48.284389 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.284393 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.284411 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=178 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.284418 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 178) Sep 16 14:28:48.284736 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=178 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.284775 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.284788 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.285660 osdx hostapd[81466]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:28:48.285667 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.285670 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.285700 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=179 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.285709 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 179) Sep 16 14:28:48.285943 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=179 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.285996 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.286010 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.286135 osdx hostapd[81466]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:28:48.286141 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.286144 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.286164 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=180 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.286170 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 180) Sep 16 14:28:48.288173 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=180 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.288219 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.288233 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.288523 osdx hostapd[81466]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:28:48.288528 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.288531 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.288546 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=181 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.288551 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 181) Sep 16 14:28:48.288802 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=181 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.288848 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.288863 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.289015 osdx hostapd[81466]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:28:48.289021 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.289027 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.289046 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=182 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.289054 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 182) Sep 16 14:28:48.289263 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=182 len=41) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.289308 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.289327 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.289469 osdx hostapd[81466]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:28:48.289475 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.289479 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.289496 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=183 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.289502 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 183) Sep 16 14:28:48.289744 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=183 len=95) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.289787 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.289801 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:48.290010 osdx hostapd[81466]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:28:48.290016 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:48.290020 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:48.290040 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=184 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:28:48.290048 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 184) Sep 16 14:28:48.290244 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=184 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:28:48.290288 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:48.290302 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:49.290393 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=8) Sep 16 14:28:49.290436 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:28:49.290628 osdx hostapd[81466]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:28:49.290635 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:49.290642 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:49.290694 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=4 id=184 len=4) from RADIUS server: EAP Failure Sep 16 14:28:49.290724 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 184) Sep 16 14:28:49.290739 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Sep 16 14:28:49.290743 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Sep 16 14:28:49.290747 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: 802.1X authentication failed, triggering MAB fallback immediately Sep 16 14:28:49.290752 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:28:49.290783 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Sep 16 14:28:49.290791 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Sep 16 14:28:49.290810 osdx hostapd[81466]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:28:49.290914 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:28:49.290937 osdx hostapd[81466]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:28:49.290940 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:49.290943 osdx hostapd[81466]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet Sep 16 14:28:50.291017 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Sep 16 14:28:50.291051 osdx hostapd[81466]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:28:50.291252 osdx hostapd[81466]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:28:50.291257 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:50.291263 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:28:50.291268 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:28:50.291319 osdx hostapd[81466]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:28:50.291323 osdx hostapd[81466]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:28:50.291326 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Authentication failed, entering held state (quiet period 60 sec) Sep 16 14:28:50.291330 osdx hostapd[81466]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Retry timeout registered for 60 seconds Sep 16 14:28:50.291338 osdx hostapd[81466]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:28:50.291341 osdx hostapd[81466]: eth1: RADIUS Received RADIUS message Sep 16 14:28:50.291345 osdx hostapd[81466]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet
Test Unsupported 802.1x Authentication With Successful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19w4BDPNyY12phtLYRfyhhe3K+el7NJcveqak4+ZGmvhycpMA9fmvUf7eIyH1btTSAnqj2FJRzHSA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.383 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.383/0.383/0.383/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.727 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.727/0.727/0.727/0.000 ms
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 4 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.669 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.669/0.669/0.669/0.000 ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately 802.1X: MAB: station successfully authenticatedShow output
Sep 16 14:28:59.415995 osdx hostapd[82030]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:28:59.416015 osdx hostapd[82030]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:28:59.416263 osdx hostapd[82030]: connect[radius]: Network is unreachable Sep 16 14:28:59.416058 osdx hostapd[82030]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:28:59.416062 osdx hostapd[82030]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:28:59.431782 osdx hostapd[82030]: Discovery mode enabled on eth1 Sep 16 14:28:59.431846 osdx hostapd[82030]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:28:59.431846 osdx hostapd[82030]: eth1: AP-ENABLED Sep 16 14:29:04.433880 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Sep 16 14:29:04.433924 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:29:04.433933 osdx hostapd[82031]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:29:04.447874 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:29:04.447911 osdx hostapd[82031]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:29:04.447916 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:29:04.447919 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:29:04.447937 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:29:04.447947 osdx hostapd[82031]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:29:04.447971 osdx hostapd[82031]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:29:04.447982 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 96) Sep 16 14:29:07.450174 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 96) Sep 16 14:29:13.455196 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 96) Sep 16 14:29:25.464905 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication Sep 16 14:29:25.464914 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately Sep 16 14:29:25.464920 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:29:25.464961 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Sep 16 14:29:25.466988 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Sep 16 14:29:25.466999 osdx hostapd[82031]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:29:25.467063 osdx hostapd[82031]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:29:25.467091 osdx hostapd[82031]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:29:25.467115 osdx hostapd[82031]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:29:25.467121 osdx hostapd[82031]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:29:25.467129 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 31) Sep 16 14:29:25.467374 osdx hostapd[82031]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:29:25.467380 osdx hostapd[82031]: eth1: RADIUS Received RADIUS message Sep 16 14:29:25.467384 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:29:25.467389 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:29:25.467404 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Sep 16 14:29:25.467417 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Sep 16 14:29:25.467421 osdx hostapd[82031]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:29:25.467429 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:29:25.467433 osdx hostapd[82031]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session E8C99F4B5D415200
Test Unsupported 802.1x Authentication With Unsuccessful MAB Fallback
Description
This scenario shows how to configure 802.1x authentication with MAB fallback. DUT1 does not support 802.1x authentication and uses an incorrect MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode 802.1x-MAB set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19rEVUD4zcIhrwVVpVExAUtYSXIA89pDh6XS1NJr9vXdujrJon9OsDQtxh0HqmuSmgkC4EzbQOftQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.240 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.240/0.240/0.240/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 2 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 4 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 5: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately 802.1X: MAB: Authentication failedShow output
Sep 16 14:29:36.442774 osdx hostapd[82649]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:29:36.442795 osdx hostapd[82649]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:29:36.443052 osdx hostapd[82649]: connect[radius]: Network is unreachable Sep 16 14:29:36.442854 osdx hostapd[82649]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:29:36.442858 osdx hostapd[82649]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:29:36.466572 osdx hostapd[82649]: Discovery mode enabled on eth1 Sep 16 14:29:36.466673 osdx hostapd[82649]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:29:36.466673 osdx hostapd[82649]: eth1: AP-ENABLED Sep 16 14:29:41.466907 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 DRIVER: Device discovered, triggering MAB authentication Sep 16 14:29:41.466943 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:29:41.466957 osdx hostapd[82650]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:29:41.482614 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: start authentication Sep 16 14:29:41.482643 osdx hostapd[82650]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:29:41.482647 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response Sep 16 14:29:41.482649 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response Sep 16 14:29:41.482665 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Sep 16 14:29:41.482672 osdx hostapd[82650]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:29:41.482691 osdx hostapd[82650]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:29:41.482703 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 145) Sep 16 14:29:44.484958 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 145) Sep 16 14:29:50.489924 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 145) Sep 16 14:30:02.498441 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: aborting authentication Sep 16 14:30:02.498450 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately Sep 16 14:30:02.498458 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:30:02.498509 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Sep 16 14:30:02.500321 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Sep 16 14:30:02.500332 osdx hostapd[82650]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:30:02.500408 osdx hostapd[82650]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:30:02.500439 osdx hostapd[82650]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:30:02.500459 osdx hostapd[82650]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:30:02.500468 osdx hostapd[82650]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:30:02.500478 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 61) Sep 16 14:30:03.500902 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Sep 16 14:30:03.500935 osdx hostapd[82650]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:30:03.501077 osdx hostapd[82650]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:30:03.501079 osdx hostapd[82650]: eth1: RADIUS Received RADIUS message Sep 16 14:30:03.501082 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:30:03.501086 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:30:03.501128 osdx hostapd[82650]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:30:03.501130 osdx hostapd[82650]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:30:03.501133 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Authentication failed, entering held state (quiet period 60 sec) Sep 16 14:30:03.501135 osdx hostapd[82650]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Retry timeout registered for 60 seconds Sep 16 14:30:03.501141 osdx hostapd[82650]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:30:03.501143 osdx hostapd[82650]: eth1: RADIUS Received RADIUS message Sep 16 14:30:03.501145 osdx hostapd[82650]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet