Mab First
This scenario shows how to configure the MAB-first
authentication mode.
Test Successful MAB Authentication With Successful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses a correct MAC address and correct 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19gUm9KAhMqoPNZc8fGl1T3kRvkwWQjX9YNex68+Ukd7gJ6jLVCfuxnwbrE5z7+qes/xZSNYfU3Sg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.317 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.317/0.317/0.317/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1+6Xks0hk+/GXvBKZIpYFG+4D0wl1CXw0I= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 1 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.273 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.273/0.273/0.273/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Sep 16 14:30:52.770662 osdx hostapd[84406]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:30:52.770707 osdx hostapd[84406]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:30:52.770994 osdx hostapd[84406]: connect[radius]: Network is unreachable Sep 16 14:30:52.770761 osdx hostapd[84406]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:30:52.770766 osdx hostapd[84406]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:30:52.784406 osdx hostapd[84406]: Discovery mode enabled on eth1 Sep 16 14:30:52.784521 osdx hostapd[84406]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:30:52.784521 osdx hostapd[84406]: eth1: AP-ENABLED Sep 16 14:30:56.135479 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:30:56.135494 osdx hostapd[84407]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:30:56.148459 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:30:56.148494 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:30:56.148512 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Sep 16 14:30:56.151119 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Sep 16 14:30:56.151135 osdx hostapd[84407]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:30:56.151229 osdx hostapd[84407]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:30:56.151375 osdx hostapd[84407]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:30:56.151411 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:30:56.151671 osdx hostapd[84407]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:30:56.151679 osdx hostapd[84407]: eth1: RADIUS Received RADIUS message Sep 16 14:30:56.151683 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:30:56.151687 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:30:56.151706 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Sep 16 14:30:56.151719 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Sep 16 14:30:56.151723 osdx hostapd[84407]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:30:56.151733 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:30:56.151736 osdx hostapd[84407]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 3B565AE7DC27ED2A
Test Successful MAB Authentication With Unsuccessful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses a correct MAC address, but wrong 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+J8Vv5biXV7Yuuoq5RaGczGqssMrR7a0qcUn+lGcNmNDzds5TwPtgCis/zBJNUnPKVKxw8OJlpvQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.301 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.301/0.301/0.301/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX18FmDSPQVeglJFNWxgeIAI6EI/yjQ5cgS4= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 1 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.354 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.354/0.354/0.354/0.000 ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Sep 16 14:31:06.595309 osdx hostapd[84981]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:31:06.595879 osdx hostapd[84981]: connect[radius]: Network is unreachable Sep 16 14:31:06.595536 osdx hostapd[84981]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:06.595581 osdx hostapd[84981]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:31:06.595585 osdx hostapd[84981]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:31:06.613544 osdx hostapd[84981]: Discovery mode enabled on eth1 Sep 16 14:31:06.613651 osdx hostapd[84981]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:31:06.613651 osdx hostapd[84981]: eth1: AP-ENABLED Sep 16 14:31:10.109899 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:31:10.109914 osdx hostapd[84982]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:31:10.133582 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:31:10.133625 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:31:10.133645 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Sep 16 14:31:10.136054 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Sep 16 14:31:10.136065 osdx hostapd[84982]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:10.136159 osdx hostapd[84982]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:10.136196 osdx hostapd[84982]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:10.136232 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:31:10.136545 osdx hostapd[84982]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:10.136553 osdx hostapd[84982]: eth1: RADIUS Received RADIUS message Sep 16 14:31:10.136558 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:10.136566 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:31:10.136594 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Sep 16 14:31:10.136620 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Sep 16 14:31:10.136624 osdx hostapd[84982]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:31:10.136634 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:31:10.136637 osdx hostapd[84982]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 63F8F7C4EB3E48F7
Test Successful MAB Authentication With Unsupported 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/Pn0W1v5BIprG0uhx4WqjfytbutRl0YGixg9OR0Zo8zq7CGmI3ExJBFit7lBdD8wR4VEE4rQ9l2A== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.322 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.322/0.322/0.322/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.934 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.934/0.934/0.934/0.000 ms
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.623 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.623/0.623/0.623/0.000 ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Sep 16 14:31:19.397796 osdx hostapd[85556]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:31:19.397810 osdx hostapd[85556]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:19.398166 osdx hostapd[85556]: connect[radius]: Network is unreachable Sep 16 14:31:19.397849 osdx hostapd[85556]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:31:19.397853 osdx hostapd[85556]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:31:19.425600 osdx hostapd[85556]: Discovery mode enabled on eth1 Sep 16 14:31:19.425713 osdx hostapd[85556]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:31:19.425713 osdx hostapd[85556]: eth1: AP-ENABLED Sep 16 14:31:24.425970 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Sep 16 14:31:24.426006 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:31:24.426013 osdx hostapd[85557]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:31:24.445607 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:31:24.445630 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:31:24.445645 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11 Sep 16 14:31:24.447285 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11 Sep 16 14:31:24.447299 osdx hostapd[85557]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:24.447363 osdx hostapd[85557]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:24.447391 osdx hostapd[85557]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:24.447651 osdx hostapd[85557]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:24.447656 osdx hostapd[85557]: eth1: RADIUS Received RADIUS message Sep 16 14:31:24.447659 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:24.447662 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:31:24.447671 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11' Sep 16 14:31:24.447682 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated Sep 16 14:31:24.447684 osdx hostapd[85557]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:31:24.447696 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:31:24.447699 osdx hostapd[85557]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 1B45161670EE9A4C
Test Unsuccessful MAB Authentication With Successful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses an incorrect MAC address, but correct 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18X0thusM2hPc3xO+FVwHpmgyVl+Bbn1+ff9tbftm/Z0BX1fuLy1zKX+aYia5lR9Bs2pvE9dTlicA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.266 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.266/0.266/0.266/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/n0Ki4y09uMHXv93C7+gyosmHhCaEKDk4= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.844 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.844/0.844/0.844/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Sep 16 14:31:35.678867 osdx hostapd[86142]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:31:35.678884 osdx hostapd[86142]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:35.679159 osdx hostapd[86142]: connect[radius]: Network is unreachable Sep 16 14:31:35.678945 osdx hostapd[86142]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:31:35.678949 osdx hostapd[86142]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:31:35.718660 osdx hostapd[86142]: Discovery mode enabled on eth1 Sep 16 14:31:35.718760 osdx hostapd[86142]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:31:35.718760 osdx hostapd[86142]: eth1: AP-ENABLED Sep 16 14:31:39.433916 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:31:39.433928 osdx hostapd[86143]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:31:39.446647 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:31:39.446685 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:31:39.446709 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Sep 16 14:31:39.449069 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Sep 16 14:31:39.449082 osdx hostapd[86143]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:39.449169 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:39.449204 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:39.449236 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:31:40.449310 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Sep 16 14:31:40.449352 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:31:40.449607 osdx hostapd[86143]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:40.449612 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.449617 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.449621 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:31:40.449676 osdx hostapd[86143]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:31:40.449679 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Sep 16 14:31:40.449684 osdx hostapd[86143]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:31:40.449687 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Sep 16 14:31:40.449695 osdx hostapd[86143]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:31:40.449704 osdx hostapd[86143]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:31:40.449715 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 145) Sep 16 14:31:40.449734 osdx hostapd[86143]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:40.449737 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.449740 osdx hostapd[86143]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet Sep 16 14:31:40.450168 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=145 len=12) from STA: EAP Response-Identity (1) Sep 16 14:31:40.450178 osdx hostapd[86143]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:31:40.450183 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'testing' Sep 16 14:31:40.450248 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.450268 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.450516 osdx hostapd[86143]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:31:40.450522 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.450526 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.450547 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=146 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:31:40.450562 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 146) Sep 16 14:31:40.450912 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=146 len=6) from STA: EAP Response-unknown (3) Sep 16 14:31:40.450981 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.450998 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.451238 osdx hostapd[86143]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:31:40.451243 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.451247 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.451267 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=147 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.451276 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 147) Sep 16 14:31:40.451714 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=147 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.451771 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.451789 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.452923 osdx hostapd[86143]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:31:40.452930 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.452935 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.452957 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=148 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.452965 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 148) Sep 16 14:31:40.453187 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=148 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.453246 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.453261 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.453413 osdx hostapd[86143]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:31:40.453419 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.453423 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.453443 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=149 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.453451 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 149) Sep 16 14:31:40.455376 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=149 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.455437 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.455450 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.455727 osdx hostapd[86143]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:31:40.455733 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.455737 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.455761 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=150 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.455768 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 150) Sep 16 14:31:40.456067 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=150 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.456112 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.456129 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.456273 osdx hostapd[86143]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:31:40.456277 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.456280 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.456294 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=151 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.456300 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 151) Sep 16 14:31:40.456494 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=151 len=43) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.456534 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.456545 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.456699 osdx hostapd[86143]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:31:40.456704 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.456709 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.456721 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=152 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.456726 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 152) Sep 16 14:31:40.456981 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=152 len=97) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.457018 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.457028 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.457184 osdx hostapd[86143]: eth1: RADIUS Received 140 bytes from RADIUS server Sep 16 14:31:40.457189 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.457192 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.457205 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=153 len=82) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.457211 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 153) Sep 16 14:31:40.457410 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=153 len=37) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.457452 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.457463 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.457596 osdx hostapd[86143]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:31:40.457602 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.457605 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.457620 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=154 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:40.457627 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 154) Sep 16 14:31:40.457883 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=154 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:31:40.457922 osdx hostapd[86143]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:40.457935 osdx hostapd[86143]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:40.458088 osdx hostapd[86143]: eth1: RADIUS Received 175 bytes from RADIUS server Sep 16 14:31:40.458093 osdx hostapd[86143]: eth1: RADIUS Received RADIUS message Sep 16 14:31:40.458097 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:40.458150 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Sep 16 14:31:40.458156 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=3 id=154 len=4) from RADIUS server: EAP Success Sep 16 14:31:40.458168 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 154) Sep 16 14:31:40.458182 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authorizing port Sep 16 14:31:40.458205 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 RADIUS: starting accounting session 22F2EED6B8E0774C Sep 16 14:31:40.458218 osdx hostapd[86143]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful MAB Authentication With Unsuccessful 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 uses an incorrect MAC address and incorrect 802.1x credentials.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19xSLZPaCEQ4GL/koyq5OKE5iYt1MbpK9GEMPcl2+5YiadiAaDfhw3Pp14mKUE7wWKvIYn3wZPDqQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.298 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.298/0.298/0.298/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX199+lYFA/nNCLuaf/B/++Up9DQl8z8hX6w= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 9 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 6: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
Sep 16 14:31:49.344522 osdx hostapd[86718]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:31:49.344537 osdx hostapd[86718]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:49.344849 osdx hostapd[86718]: connect[radius]: Network is unreachable Sep 16 14:31:49.344578 osdx hostapd[86718]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:31:49.344582 osdx hostapd[86718]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:31:49.364341 osdx hostapd[86718]: Discovery mode enabled on eth1 Sep 16 14:31:49.364455 osdx hostapd[86718]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:31:49.364455 osdx hostapd[86718]: eth1: AP-ENABLED Sep 16 14:31:52.899728 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:31:52.899743 osdx hostapd[86719]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:31:52.912351 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:31:52.912389 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:31:52.912409 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Sep 16 14:31:52.914783 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Sep 16 14:31:52.914797 osdx hostapd[86719]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:31:52.914888 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:52.914922 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:52.914955 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:31:53.915001 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Sep 16 14:31:53.915033 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:31:53.915201 osdx hostapd[86719]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:53.915204 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.915209 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.915213 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:31:53.915257 osdx hostapd[86719]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:31:53.915259 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Sep 16 14:31:53.915262 osdx hostapd[86719]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:31:53.915264 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Sep 16 14:31:53.915270 osdx hostapd[86719]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:31:53.915277 osdx hostapd[86719]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:31:53.915285 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 73) Sep 16 14:31:53.915299 osdx hostapd[86719]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:31:53.915302 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.915305 osdx hostapd[86719]: eth1: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet Sep 16 14:31:53.915785 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=73 len=10) from STA: EAP Response-Identity (1) Sep 16 14:31:53.915796 osdx hostapd[86719]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:31:53.915799 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: STA identity 'wrong' Sep 16 14:31:53.915859 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.915875 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.916070 osdx hostapd[86719]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:31:53.916075 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.916079 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.916101 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=74 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:31:53.916108 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 74) Sep 16 14:31:53.916318 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=74 len=6) from STA: EAP Response-unknown (3) Sep 16 14:31:53.916364 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.916379 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.916550 osdx hostapd[86719]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:31:53.916555 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.916558 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.916572 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=75 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.916577 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 75) Sep 16 14:31:53.916868 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=75 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.916898 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.916909 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.918018 osdx hostapd[86719]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:31:53.918026 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.918030 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.918057 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=76 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.918065 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 76) Sep 16 14:31:53.918229 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=76 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.918278 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.918292 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.918408 osdx hostapd[86719]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:31:53.918414 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.918418 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.918435 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=77 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.918442 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 77) Sep 16 14:31:53.919863 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=77 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.919908 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.919921 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.920207 osdx hostapd[86719]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:31:53.920214 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.920219 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.920250 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=78 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.920256 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 78) Sep 16 14:31:53.920516 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=78 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.920554 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.920567 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.920687 osdx hostapd[86719]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:31:53.920692 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.920695 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.920707 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=79 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.920715 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 79) Sep 16 14:31:53.920882 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=79 len=41) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.920927 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.920940 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.921084 osdx hostapd[86719]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:31:53.921088 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.921092 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.921106 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=80 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.921111 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 80) Sep 16 14:31:53.921417 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=80 len=95) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.921458 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.921470 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:53.921645 osdx hostapd[86719]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:31:53.921650 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:53.921654 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:53.921667 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=1 id=81 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:31:53.921672 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 81) Sep 16 14:31:53.921856 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: received EAP packet (code=2 id=81 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:31:53.921894 osdx hostapd[86719]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:31:53.921908 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:31:54.922007 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=8) Sep 16 14:31:54.922039 osdx hostapd[86719]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:31:54.922212 osdx hostapd[86719]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:31:54.922217 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:54.922223 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:31:54.922276 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: decapsulated EAP packet (code=4 id=81 len=4) from RADIUS server: EAP Failure Sep 16 14:31:54.922304 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 81) Sep 16 14:31:54.922320 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: unauthorizing port Sep 16 14:31:54.922334 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Sep 16 14:31:54.922338 osdx hostapd[86719]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) Sep 16 14:31:54.922343 osdx hostapd[86719]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:31:54.922348 osdx hostapd[86719]: eth1: RADIUS Received RADIUS message Sep 16 14:31:54.922351 osdx hostapd[86719]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsuccessful MAB Authentication With Unsupported 802.1x Fallback
Description
This scenario shows how to configure MAB authentication with 802.1x fallback. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode MAB-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18AGmqjcexxhbhz0U8mQwfp9mWsiJdcV3dvS16QN12fvflshXHW4JnAsiIM/2KrbQYi5wfw1JpwHA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.352 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.352/0.352/0.352/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 mac '00:11:22:33:44:55' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 5: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X IEEE 802.1X: EAP authentication timeoutShow output
Sep 16 14:32:03.444011 osdx hostapd[87289]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:32:03.444026 osdx hostapd[87289]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:32:03.444285 osdx hostapd[87289]: connect[radius]: Network is unreachable Sep 16 14:32:03.444067 osdx hostapd[87289]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30 Sep 16 14:32:03.444071 osdx hostapd[87289]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:32:03.479695 osdx hostapd[87289]: Discovery mode enabled on eth1 Sep 16 14:32:03.479785 osdx hostapd[87289]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:32:03.479810 osdx hostapd[87289]: eth1: AP-ENABLED Sep 16 14:32:08.479889 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 DRIVER: Device discovered, triggering MAB authentication Sep 16 14:32:08.479929 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Sep 16 14:32:08.479939 osdx hostapd[87290]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:32:08.495705 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: Starting MAB authentication Sep 16 14:32:08.495734 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Sep 16 14:32:08.495751 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Sep 16 14:32:08.497449 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Sep 16 14:32:08.497459 osdx hostapd[87290]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:32:08.497520 osdx hostapd[87290]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:32:08.497548 osdx hostapd[87290]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:32:09.497636 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Sep 16 14:32:09.497672 osdx hostapd[87290]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:32:09.497822 osdx hostapd[87290]: eth1: RADIUS Received 20 bytes from RADIUS server Sep 16 14:32:09.497826 osdx hostapd[87290]: eth1: RADIUS Received RADIUS message Sep 16 14:32:09.497830 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:32:09.497835 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Sep 16 14:32:09.497887 osdx hostapd[87290]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled Sep 16 14:32:09.497890 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first mode: MAB failed, transitioning to 802.1X Sep 16 14:32:09.497894 osdx hostapd[87290]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:32:09.497898 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-first: 802.1X authentication started Sep 16 14:32:09.497906 osdx hostapd[87290]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:32:09.497921 osdx hostapd[87290]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:32:09.497938 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 239) Sep 16 14:32:12.499088 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 239) Sep 16 14:32:17.891504 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Sep 16 14:32:18.504072 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: Sending EAP Packet (identifier 239) Sep 16 14:32:26.112639 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Sep 16 14:32:30.515056 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: aborting authentication Sep 16 14:32:30.515067 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying Sep 16 14:32:30.515085 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 MLME: MLME-DEAUTHENTICATE.indication(00:11:22:33:44:55, 2) Sep 16 14:32:30.515088 osdx hostapd[87290]: eth1: STA 00:11:22:33:44:55 MLME: MLME-DELETEKEYS.request(00:11:22:33:44:55)