Only 802.1X
This scenario shows how to configure the only-802.1x
authentication mode.
Test Successful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX19Yf6vMvJQzdFDnRm4uQCcUkn2bizDQFKClx2ih+RYTqbNbM0WMyHvcB8hOYzoalgbbK1KuL4S5zw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.292 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.292/0.292/0.292/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1/ehtjW4GQZzntd+V1W4x+YxrGA8mU0cjQ= set interfaces ethernet eth1 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show status on DUT1 and check whether the output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name testing
Step 7: Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.537 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.537/0.537/0.537/0.000 ms
Step 8: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Sep 16 14:26:57.725960 osdx hostapd[77984]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:26:57.725971 osdx hostapd[77984]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:26:57.726210 osdx hostapd[77984]: connect[radius]: Network is unreachable Sep 16 14:26:57.726006 osdx hostapd[77984]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Sep 16 14:26:57.726010 osdx hostapd[77984]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:26:57.757879 osdx hostapd[77984]: Discovery mode enabled on eth1 Sep 16 14:26:57.757980 osdx hostapd[77984]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:26:57.757980 osdx hostapd[77984]: eth1: AP-ENABLED Sep 16 14:27:01.064170 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:27:01.064182 osdx hostapd[77985]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:27:01.081897 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:27:01.081931 osdx hostapd[77985]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:27:01.081951 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:27:01.081961 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:27:01.081975 osdx hostapd[77985]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:27:01.081987 osdx hostapd[77985]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:27:01.082001 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 213) Sep 16 14:27:01.082370 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=213 len=12) from STA: EAP Response-Identity (1) Sep 16 14:27:01.082380 osdx hostapd[77985]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:27:01.082384 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing' Sep 16 14:27:01.082411 osdx hostapd[77985]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:27:01.084890 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.084923 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.085157 osdx hostapd[77985]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:27:01.085163 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.085168 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.085190 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=214 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:27:01.085197 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 214) Sep 16 14:27:01.085427 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=214 len=6) from STA: EAP Response-unknown (3) Sep 16 14:27:01.085473 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.085484 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.085636 osdx hostapd[77985]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:27:01.085642 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.085646 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.085660 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=215 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.085666 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 215) Sep 16 14:27:01.085987 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=215 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.086024 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.086033 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.086898 osdx hostapd[77985]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:27:01.086904 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.086907 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.086925 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=216 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.086932 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 216) Sep 16 14:27:01.087129 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=216 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.087167 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.087176 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.087290 osdx hostapd[77985]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:27:01.087295 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.087297 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.087309 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=217 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.087314 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 217) Sep 16 14:27:01.088704 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=217 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.088744 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.088753 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.088995 osdx hostapd[77985]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:27:01.089000 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.089003 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.089018 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=218 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.089024 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 218) Sep 16 14:27:01.089301 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=218 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.089332 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.089339 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.089464 osdx hostapd[77985]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:27:01.089468 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.089470 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.089481 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=219 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.089486 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 219) Sep 16 14:27:01.089632 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=219 len=43) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.089660 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.089667 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.089822 osdx hostapd[77985]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:27:01.089826 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.089829 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.01 sec Sep 16 14:27:01.089841 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=220 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.089846 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 220) Sep 16 14:27:01.090126 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=220 len=97) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.090165 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.090176 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.090339 osdx hostapd[77985]: eth1: RADIUS Received 140 bytes from RADIUS server Sep 16 14:27:01.090343 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.090346 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.090358 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=221 len=82) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.090362 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 221) Sep 16 14:27:01.090522 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=221 len=37) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.090552 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.090560 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.090713 osdx hostapd[77985]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:27:01.090718 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.090722 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.090735 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=222 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:01.090744 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 222) Sep 16 14:27:01.090923 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=222 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:27:01.090980 osdx hostapd[77985]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:01.090995 osdx hostapd[77985]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:01.091176 osdx hostapd[77985]: eth1: RADIUS Received 175 bytes from RADIUS server Sep 16 14:27:01.091182 osdx hostapd[77985]: eth1: RADIUS Received RADIUS message Sep 16 14:27:01.091186 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:01.091208 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Sep 16 14:27:01.091212 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=222 len=4) from RADIUS server: EAP Success Sep 16 14:27:01.091227 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 222) Sep 16 14:27:01.091244 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port Sep 16 14:27:01.091247 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session C0C93A73A43B7BEF Sep 16 14:27:01.091251 osdx hostapd[77985]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX181/yrlvAenWJwn4dnJANanunYLla21LreQV2kfb5n+o011qxaeym+D+zdWsSaDHapwQjBB1EvE6A== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.345 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.345/0.345/0.345/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX18yNVGp7WkkwOVZnpEkDEoPZtUZpkI8ZbM= set interfaces ethernet eth1 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 0 EAPoL Frames (Tx) 0 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 0 Req ID Frames (Rx) 0 Resp Frames (Tx) 0 Start Frames (Tx) 0
Step 5: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 6: Run the command interfaces ethernet eth1 supplicant show stats on DUT1 and check whether the output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 7: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 8: Expect a failure in the following command:
Ping the IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 9: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
Sep 16 14:27:09.827044 osdx hostapd[78560]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:27:09.827057 osdx hostapd[78560]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:27:09.827315 osdx hostapd[78560]: connect[radius]: Network is unreachable Sep 16 14:27:09.827100 osdx hostapd[78560]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Sep 16 14:27:09.827103 osdx hostapd[78560]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:27:09.850849 osdx hostapd[78560]: Discovery mode enabled on eth1 Sep 16 14:27:09.850940 osdx hostapd[78560]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:27:09.850940 osdx hostapd[78560]: eth1: AP-ENABLED Sep 16 14:27:13.337189 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:27:13.337204 osdx hostapd[78561]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:27:13.350911 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:27:13.350949 osdx hostapd[78561]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:27:13.350968 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA Sep 16 14:27:13.350982 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:27:13.350991 osdx hostapd[78561]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:27:13.351007 osdx hostapd[78561]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:27:13.351022 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 245) Sep 16 14:27:13.351380 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=245 len=10) from STA: EAP Response-Identity (1) Sep 16 14:27:13.351392 osdx hostapd[78561]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH Sep 16 14:27:13.351397 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'wrong' Sep 16 14:27:13.351426 osdx hostapd[78561]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:27:13.353865 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.353904 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.354213 osdx hostapd[78561]: eth1: RADIUS Received 80 bytes from RADIUS server Sep 16 14:27:13.354220 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.354225 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.354250 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=246 len=22) from RADIUS server: EAP-Request-MD5 (4) Sep 16 14:27:13.354259 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 246) Sep 16 14:27:13.354621 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=246 len=6) from STA: EAP Response-unknown (3) Sep 16 14:27:13.354679 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.354905 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.354915 osdx hostapd[78561]: eth1: RADIUS Received 64 bytes from RADIUS server Sep 16 14:27:13.354918 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.354923 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.354941 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=247 len=6) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.354948 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 247) Sep 16 14:27:13.355365 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=247 len=194) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.355417 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.355482 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.356549 osdx hostapd[78561]: eth1: RADIUS Received 1068 bytes from RADIUS server Sep 16 14:27:13.356555 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.356560 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.356587 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=248 len=1004) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.356595 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 248) Sep 16 14:27:13.356814 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=248 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.356871 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.356884 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.357036 osdx hostapd[78561]: eth1: RADIUS Received 229 bytes from RADIUS server Sep 16 14:27:13.357043 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.357047 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.357066 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=249 len=171) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.357073 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 249) Sep 16 14:27:13.358576 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=249 len=103) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.358631 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.358686 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.358976 osdx hostapd[78561]: eth1: RADIUS Received 115 bytes from RADIUS server Sep 16 14:27:13.358986 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.358991 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.359016 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=250 len=57) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.359028 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 250) Sep 16 14:27:13.359819 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=250 len=6) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.359872 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.359889 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.360056 osdx hostapd[78561]: eth1: RADIUS Received 98 bytes from RADIUS server Sep 16 14:27:13.360063 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.360068 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.360092 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=251 len=40) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.360099 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 251) Sep 16 14:27:13.360338 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=251 len=41) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.360383 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.360440 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.360577 osdx hostapd[78561]: eth1: RADIUS Received 131 bytes from RADIUS server Sep 16 14:27:13.360582 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.360586 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.360603 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=252 len=73) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.360610 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 252) Sep 16 14:27:13.360910 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=252 len=95) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.360962 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.360983 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:13.361173 osdx hostapd[78561]: eth1: RADIUS Received 104 bytes from RADIUS server Sep 16 14:27:13.361180 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:13.361184 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:13.361204 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=253 len=46) from RADIUS server: EAP-Request-PEAP (25) Sep 16 14:27:13.361211 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 253) Sep 16 14:27:13.361451 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=253 len=46) from STA: EAP Response-PEAP (25) Sep 16 14:27:13.361503 osdx hostapd[78561]: eth1: RADIUS Sending RADIUS message to authentication server Sep 16 14:27:13.361557 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds Sep 16 14:27:14.361661 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Resending RADIUS message (id=8) Sep 16 14:27:14.361697 osdx hostapd[78561]: eth1: RADIUS Next RADIUS client retransmit in 2 seconds Sep 16 14:27:14.361896 osdx hostapd[78561]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:27:14.361900 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:14.361903 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Sep 16 14:27:14.361958 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=4 id=253 len=4) from RADIUS server: EAP Failure Sep 16 14:27:14.361984 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 253) Sep 16 14:27:14.361997 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:27:14.362001 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Sep 16 14:27:14.362004 osdx hostapd[78561]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) Sep 16 14:27:14.362009 osdx hostapd[78561]: eth1: RADIUS Received 44 bytes from RADIUS server Sep 16 14:27:14.362012 osdx hostapd[78561]: eth1: RADIUS Received RADIUS message Sep 16 14:27:14.362015 osdx hostapd[78561]: eth1: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsupported 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth1 address 192.168.100.1/24 set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth1 authenticator aaa authentication list1 set interfaces ethernet eth1 authenticator log-level debug set interfaces ethernet eth1 authenticator mode only-802.1x set interfaces ethernet eth1 authenticator quiet-period 60 set interfaces ethernet eth1 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX185N5GlWwkOjnghWyNaAkCe5KEnCEygUAorjDjyrF+8p0Jpeh4v5CX8glYqi9tCsarQMX3o+8QKhw== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping the IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.219 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.219/0.219/0.219/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth1 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 5: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 6: Run the command interfaces ethernet eth1 authenticator show stats on DUT0 and check whether the output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:11 Session User Name N/A
Step 7: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:
IEEE 802.1X: EAP authentication timeoutShow output
Sep 16 14:27:26.604969 osdx hostapd[79139]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported. Sep 16 14:27:26.605676 osdx hostapd[79139]: eth1: RADIUS Authentication server 10.215.168.1:1812 Sep 16 14:27:26.605944 osdx hostapd[79139]: connect[radius]: Network is unreachable Sep 16 14:27:26.605727 osdx hostapd[79139]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Sep 16 14:27:26.605730 osdx hostapd[79139]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Sep 16 14:27:26.620766 osdx hostapd[79139]: Discovery mode enabled on eth1 Sep 16 14:27:26.621403 osdx hostapd[79139]: eth1: interface state UNINITIALIZED->ENABLED Sep 16 14:27:26.621403 osdx hostapd[79139]: eth1: AP-ENABLED Sep 16 14:27:31.620858 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication Sep 16 14:27:31.620891 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added Sep 16 14:27:31.620914 osdx hostapd[79140]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Sep 16 14:27:31.640813 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication Sep 16 14:27:31.640847 osdx hostapd[79140]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Sep 16 14:27:31.640872 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port Sep 16 14:27:31.640881 osdx hostapd[79140]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Sep 16 14:27:31.640944 osdx hostapd[79140]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE Sep 16 14:27:31.640957 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 251) Sep 16 14:27:34.643090 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 251) Sep 16 14:27:39.907165 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Sep 16 14:27:40.647987 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 251) Sep 16 14:27:48.321865 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Sep 16 14:27:52.657128 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication Sep 16 14:27:52.657150 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying Sep 16 14:27:52.657173 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 MLME: MLME-DEAUTHENTICATE.indication(de:ad:be:ef:6c:11, 2) Sep 16 14:27:52.657177 osdx hostapd[79140]: eth1: STA de:ad:be:ef:6c:11 MLME: MLME-DELETEKEYS.request(de:ad:be:ef:6c:11)