Reauth Period

This scenario shows how to configure the reauthentication period in a device with 802.1x/MAB authentication.

../../../../../_images/topologydut0dut1.svg

Test Reauth Period In 802.1X Mode

Description

This scenario shows how to configure the reauthentication period in a device with 802.1x authentication.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth1 address 192.168.100.1/24
set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth1 authenticator aaa authentication list1
set interfaces ethernet eth1 authenticator log-level debug
set interfaces ethernet eth1 authenticator mode only-802.1x
set interfaces ethernet eth1 authenticator quiet-period 60
set interfaces ethernet eth1 authenticator reauth-period 20
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19j5JYp6238wwKsnN1Uz9Dz1Wh2J+MlgCFsIWqlbIBp+ZRPWsiAi2IFzfU9+OUjWwouqSVIN5SRlg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.301 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.301/0.301/0.301/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 192.168.100.2/24
set interfaces ethernet eth1 supplicant encrypted-password U2FsdGVkX1+qxIwlV4iaqRZMhkf61GUoT9xWZlquUjc=
set interfaces ethernet eth1 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

IEEE 802.1X: authenticated
Show output
Sep 16 14:32:42.722707 osdx hostapd[87870]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported.
Sep 16 14:32:42.722720 osdx hostapd[87870]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:32:42.723044 osdx hostapd[87870]: connect[radius]: Network is unreachable
Sep 16 14:32:42.722762 osdx hostapd[87870]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2
Sep 16 14:32:42.722766 osdx hostapd[87870]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Sep 16 14:32:42.754503 osdx hostapd[87870]: Discovery mode enabled on eth1
Sep 16 14:32:42.754610 osdx hostapd[87870]: eth1: interface state UNINITIALIZED->ENABLED
Sep 16 14:32:42.754610 osdx hostapd[87870]: eth1: AP-ENABLED
Sep 16 14:32:42.754503 osdx hostapd[87870]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames
Sep 16 14:32:44.480494 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:46.102846 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added
Sep 16 14:32:46.102859 osdx hostapd[87871]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Sep 16 14:32:46.118581 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication
Sep 16 14:32:46.118614 osdx hostapd[87871]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames
Sep 16 14:32:46.118633 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAPOL-Start from STA
Sep 16 14:32:46.118645 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port
Sep 16 14:32:46.118654 osdx hostapd[87871]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Sep 16 14:32:46.118670 osdx hostapd[87871]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE
Sep 16 14:32:46.118687 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 102)
Sep 16 14:32:46.119064 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=102 len=12) from STA: EAP Response-Identity (1)
Sep 16 14:32:46.119075 osdx hostapd[87871]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH
Sep 16 14:32:46.119080 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing'
Sep 16 14:32:46.119106 osdx hostapd[87871]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:32:46.121631 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.121666 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.121946 osdx hostapd[87871]: eth1: RADIUS Received 80 bytes from RADIUS server
Sep 16 14:32:46.121952 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.121957 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.121978 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=103 len=22) from RADIUS server: EAP-Request-MD5 (4)
Sep 16 14:32:46.121985 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 103)
Sep 16 14:32:46.122279 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=103 len=6) from STA: EAP Response-unknown (3)
Sep 16 14:32:46.122349 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.122366 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.122569 osdx hostapd[87871]: eth1: RADIUS Received 64 bytes from RADIUS server
Sep 16 14:32:46.122575 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.122579 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.122597 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=104 len=6) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.122605 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 104)
Sep 16 14:32:46.122996 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=104 len=194) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.123049 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.123066 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.124206 osdx hostapd[87871]: eth1: RADIUS Received 1068 bytes from RADIUS server
Sep 16 14:32:46.124213 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.124217 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.124246 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=105 len=1004) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.124254 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 105)
Sep 16 14:32:46.124485 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=105 len=6) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.124543 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.124558 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.124692 osdx hostapd[87871]: eth1: RADIUS Received 229 bytes from RADIUS server
Sep 16 14:32:46.124698 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.124703 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.124719 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=106 len=171) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.124726 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 106)
Sep 16 14:32:46.126657 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=106 len=103) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.126712 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.126727 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.127057 osdx hostapd[87871]: eth1: RADIUS Received 115 bytes from RADIUS server
Sep 16 14:32:46.127063 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.127068 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.127088 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=107 len=57) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.127096 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 107)
Sep 16 14:32:46.127397 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=107 len=6) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.127443 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.127456 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.127631 osdx hostapd[87871]: eth1: RADIUS Received 98 bytes from RADIUS server
Sep 16 14:32:46.127637 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.127642 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.127658 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=108 len=40) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.127665 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 108)
Sep 16 14:32:46.127903 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=108 len=43) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.127939 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.127950 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.128081 osdx hostapd[87871]: eth1: RADIUS Received 131 bytes from RADIUS server
Sep 16 14:32:46.128087 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.128090 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.128105 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=109 len=73) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.128111 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 109)
Sep 16 14:32:46.128418 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=109 len=97) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.128465 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.128480 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.128667 osdx hostapd[87871]: eth1: RADIUS Received 140 bytes from RADIUS server
Sep 16 14:32:46.128672 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.128675 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.128693 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=110 len=82) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.128699 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 110)
Sep 16 14:32:46.128893 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=110 len=37) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.128935 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.128948 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.129112 osdx hostapd[87871]: eth1: RADIUS Received 104 bytes from RADIUS server
Sep 16 14:32:46.129117 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.129121 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.129136 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=111 len=46) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:32:46.129147 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 111)
Sep 16 14:32:46.129342 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=111 len=46) from STA: EAP Response-PEAP (25)
Sep 16 14:32:46.129378 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:32:46.129392 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:32:46.129604 osdx hostapd[87871]: eth1: RADIUS Received 175 bytes from RADIUS server
Sep 16 14:32:46.129610 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:32:46.129613 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:32:46.129637 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing'
Sep 16 14:32:46.129641 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=111 len=4) from RADIUS server: EAP Success
Sep 16 14:32:46.129656 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 111)
Sep 16 14:32:46.129670 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:32:46.129673 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session AA601CD29D6CC1A8
Sep 16 14:32:46.129677 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)

Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

IEEE 802.1X: Re-authentication period expired
Show output
Sep 16 14:32:46.908765 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:49.018071 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:51.093160 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:53.162061 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:55.231299 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:57.309156 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:32:59.381700 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:01.465749 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:03.537755 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:05.645329 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:06.135854 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication
Sep 16 14:33:06.135864 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Starting re-authentication (port will be unauthorized until authentication succeeds)
Sep 16 14:33:06.135868 osdx hostapd[87871]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Sep 16 14:33:06.135897 osdx hostapd[87871]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE
Sep 16 14:33:06.135906 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 71)
Sep 16 14:33:06.136259 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=71 len=12) from STA: EAP Response-Identity (1)
Sep 16 14:33:06.136274 osdx hostapd[87871]: IEEE 802.1X: OSDX-EAP: getDecision: -> PASSTHROUGH
Sep 16 14:33:06.136279 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: STA identity 'testing'
Sep 16 14:33:06.136356 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.136454 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.136650 osdx hostapd[87871]: eth1: RADIUS Received 80 bytes from RADIUS server
Sep 16 14:33:06.136657 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.136662 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.136686 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=72 len=22) from RADIUS server: EAP-Request-MD5 (4)
Sep 16 14:33:06.136693 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 72)
Sep 16 14:33:06.136931 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=72 len=6) from STA: EAP Response-unknown (3)
Sep 16 14:33:06.136987 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.137004 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.137208 osdx hostapd[87871]: eth1: RADIUS Received 64 bytes from RADIUS server
Sep 16 14:33:06.137214 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.137218 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.137236 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=73 len=6) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.137243 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 73)
Sep 16 14:33:06.137610 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=73 len=194) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.137652 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.137664 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.138815 osdx hostapd[87871]: eth1: RADIUS Received 1068 bytes from RADIUS server
Sep 16 14:33:06.138821 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.138825 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.138853 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=74 len=1004) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.138861 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 74)
Sep 16 14:33:06.139088 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=74 len=6) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.139148 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.139162 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.139312 osdx hostapd[87871]: eth1: RADIUS Received 229 bytes from RADIUS server
Sep 16 14:33:06.139318 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.139321 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.139339 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=75 len=171) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.139345 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 75)
Sep 16 14:33:06.141002 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=75 len=103) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.141071 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.141088 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.141446 osdx hostapd[87871]: eth1: RADIUS Received 115 bytes from RADIUS server
Sep 16 14:33:06.141454 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.141458 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.141479 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=76 len=57) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.141486 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 76)
Sep 16 14:33:06.141781 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=76 len=6) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.141848 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.141864 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.142019 osdx hostapd[87871]: eth1: RADIUS Received 98 bytes from RADIUS server
Sep 16 14:33:06.142025 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.142029 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.142047 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=77 len=40) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.142055 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 77)
Sep 16 14:33:06.142279 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=77 len=43) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.142333 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.142348 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.142499 osdx hostapd[87871]: eth1: RADIUS Received 131 bytes from RADIUS server
Sep 16 14:33:06.142505 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.142509 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.142536 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=78 len=73) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.142543 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 78)
Sep 16 14:33:06.142899 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=78 len=97) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.142949 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.142963 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.143159 osdx hostapd[87871]: eth1: RADIUS Received 140 bytes from RADIUS server
Sep 16 14:33:06.143167 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.143172 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.143197 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=79 len=82) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.143204 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 79)
Sep 16 14:33:06.143440 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=79 len=37) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.143491 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.143540 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.143682 osdx hostapd[87871]: eth1: RADIUS Received 104 bytes from RADIUS server
Sep 16 14:33:06.143687 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.143690 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.143707 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=1 id=80 len=46) from RADIUS server: EAP-Request-PEAP (25)
Sep 16 14:33:06.143713 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 80)
Sep 16 14:33:06.143943 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: received EAP packet (code=2 id=80 len=46) from STA: EAP Response-PEAP (25)
Sep 16 14:33:06.144002 osdx hostapd[87871]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:06.144016 osdx hostapd[87871]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:06.144221 osdx hostapd[87871]: eth1: RADIUS Received 175 bytes from RADIUS server
Sep 16 14:33:06.144228 osdx hostapd[87871]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:06.144232 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:06.144256 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing'
Sep 16 14:33:06.144260 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: decapsulated EAP packet (code=3 id=80 len=4) from RADIUS server: EAP Success
Sep 16 14:33:06.144278 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 80)
Sep 16 14:33:06.144288 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:33:06.144292 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session AA601CD29D6CC1A8
Sep 16 14:33:06.144296 osdx hostapd[87871]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)

Test Reauth Period In MAB Mode

Description

This scenario shows how to configure the reauthentication period in a device with MAB authentication.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth1 address 192.168.100.1/24
set interfaces ethernet eth1 authenticator aaa authentication list1
set interfaces ethernet eth1 authenticator log-level debug
set interfaces ethernet eth1 authenticator mode only-MAB
set interfaces ethernet eth1 authenticator quiet-period 60
set interfaces ethernet eth1 authenticator reauth-period 20
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/nqexSTYfO0W2FBctY6j2Oqlhktb3QZIgiRucSzY9lkQESwkbnOok2hQkXxv22m2iRF9qjwwzstA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.467 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.467/0.467/0.467/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

MAB: station successfully authenticated
Show output
Sep 16 14:33:16.465863 osdx hostapd[88523]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported.
Sep 16 14:33:16.465882 osdx hostapd[88523]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:33:16.466164 osdx hostapd[88523]: connect[radius]: Network is unreachable
Sep 16 14:33:16.465925 osdx hostapd[88523]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-only, eap_server=0, eap_quiet_period=60, eap_max_retrans=5
Sep 16 14:33:16.465931 osdx hostapd[88523]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Sep 16 14:33:16.489698 osdx hostapd[88523]: Discovery mode enabled on eth1
Sep 16 14:33:16.489834 osdx hostapd[88523]: eth1: interface state UNINITIALIZED->ENABLED
Sep 16 14:33:16.489834 osdx hostapd[88523]: eth1: AP-ENABLED
Sep 16 14:33:20.111307 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:21.492084 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication
Sep 16 14:33:21.492125 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added
Sep 16 14:33:21.492135 osdx hostapd[88524]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Sep 16 14:33:21.505720 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-only mode: Starting MAB authentication
Sep 16 14:33:21.505760 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query
Sep 16 14:33:21.505779 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11
Sep 16 14:33:21.508143 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11
Sep 16 14:33:21.508156 osdx hostapd[88524]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:33:21.508245 osdx hostapd[88524]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:21.508282 osdx hostapd[88524]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:21.508588 osdx hostapd[88524]: eth1: RADIUS Received 20 bytes from RADIUS server
Sep 16 14:33:21.508594 osdx hostapd[88524]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:21.508599 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:21.508603 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response
Sep 16 14:33:21.508614 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11'
Sep 16 14:33:21.508629 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated
Sep 16 14:33:21.508632 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds)
Sep 16 14:33:21.508635 osdx hostapd[88524]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled
Sep 16 14:33:21.508650 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:33:21.508654 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session AED317FA1FC4C9AB

Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

IEEE 802.1X: Re-authentication period expired
Show output
Sep 16 14:33:24.593311 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:27.857857 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:31.059165 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:34.275030 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:37.433975 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:40.596768 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:41.523032 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication
Sep 16 14:33:41.523053 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query
Sep 16 14:33:41.523113 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11
Sep 16 14:33:41.523146 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11
Sep 16 14:33:41.523172 osdx hostapd[88524]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:33:41.523215 osdx hostapd[88524]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:33:41.523510 osdx hostapd[88524]: eth1: RADIUS Received 20 bytes from RADIUS server
Sep 16 14:33:41.523514 osdx hostapd[88524]: eth1: RADIUS Received RADIUS message
Sep 16 14:33:41.523517 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:33:41.523521 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response
Sep 16 14:33:41.523549 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated
Sep 16 14:33:41.523553 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds)
Sep 16 14:33:41.523556 osdx hostapd[88524]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled
Sep 16 14:33:41.523560 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:33:41.523563 osdx hostapd[88524]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session AED317FA1FC4C9AB

Test Reauth Period In MAB-Fallback Mode

Description

This scenario shows how to configure the reauthentication period in a device with 802.1x/MAB authentication.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth1 address 192.168.100.1/24
set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth1 authenticator aaa authentication list1
set interfaces ethernet eth1 authenticator log-level debug
set interfaces ethernet eth1 authenticator mode 802.1x-MAB
set interfaces ethernet eth1 authenticator quiet-period 60
set interfaces ethernet eth1 authenticator reauth-period 20
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18O6EwoZWEyx5WbQZFd61a4MA8uStoHsJmm97osYlLe/12TX+Zbc6q+0c5VYI9U1LIdkfS6C6wF1Q==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=1.38 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.383/1.383/1.383/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

MAB: station successfully authenticated
Show output
Sep 16 14:33:51.495390 osdx hostapd[89156]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported.
Sep 16 14:33:51.495404 osdx hostapd[89156]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:33:51.495640 osdx hostapd[89156]: connect[radius]: Network is unreachable
Sep 16 14:33:51.495435 osdx hostapd[89156]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X+MAB-fallback, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30
Sep 16 14:33:51.495438 osdx hostapd[89156]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Sep 16 14:33:51.511013 osdx hostapd[89156]: Discovery mode enabled on eth1
Sep 16 14:33:51.511085 osdx hostapd[89156]: eth1: interface state UNINITIALIZED->ENABLED
Sep 16 14:33:51.511085 osdx hostapd[89156]: eth1: AP-ENABLED
Sep 16 14:33:51.511014 osdx hostapd[89156]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames
Sep 16 14:33:55.376877 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:33:56.513357 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication
Sep 16 14:33:56.513400 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added
Sep 16 14:33:56.513409 osdx hostapd[89157]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Sep 16 14:33:56.527015 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: start authentication
Sep 16 14:33:56.527051 osdx hostapd[89157]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames
Sep 16 14:33:56.527055 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback mode: Scheduling MAB trigger in 30 seconds if no 802.1X response
Sep 16 14:33:56.527058 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response
Sep 16 14:33:56.527078 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port
Sep 16 14:33:56.527087 osdx hostapd[89157]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Sep 16 14:33:56.527106 osdx hostapd[89157]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE
Sep 16 14:33:56.527120 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 192)
Sep 16 14:33:59.529359 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 192)
Sep 16 14:33:59.557217 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:03.745751 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:05.534364 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 192)
Sep 16 14:34:07.972163 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:12.172218 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:16.416986 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:17.545373 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: aborting authentication
Sep 16 14:34:17.545380 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: EAP max retrans reached, triggering MAB fallback immediately
Sep 16 14:34:17.545385 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query
Sep 16 14:34:17.545419 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11
Sep 16 14:34:17.547192 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11
Sep 16 14:34:17.547202 osdx hostapd[89157]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:34:17.547268 osdx hostapd[89157]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:34:17.547300 osdx hostapd[89157]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:34:17.547318 osdx hostapd[89157]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Sep 16 14:34:17.547324 osdx hostapd[89157]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE
Sep 16 14:34:17.547332 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 7)
Sep 16 14:34:17.547640 osdx hostapd[89157]: eth1: RADIUS Received 20 bytes from RADIUS server
Sep 16 14:34:17.547645 osdx hostapd[89157]: eth1: RADIUS Received RADIUS message
Sep 16 14:34:17.547648 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:34:17.547651 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response
Sep 16 14:34:17.547660 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11'
Sep 16 14:34:17.547670 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated
Sep 16 14:34:17.547674 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds)
Sep 16 14:34:17.547677 osdx hostapd[89157]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled
Sep 16 14:34:17.547684 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:34:17.547687 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session 9E571280B025A70B

Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

IEEE 802.1X: Re-authentication period expired
Show output
Sep 16 14:34:20.965548 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:24.185605 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:27.378286 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:30.553539 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:33.795566 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:37.026802 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:37.565340 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication
Sep 16 14:34:37.565356 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB fallback: Scheduling MAB trigger in 30 seconds if no 802.1X response
Sep 16 14:34:37.565359 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Timeout registered, will trigger if no 802.1X response
Sep 16 14:34:37.565389 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: unauthorizing port
Sep 16 14:34:37.565395 osdx hostapd[89157]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Sep 16 14:34:37.565404 osdx hostapd[89157]: IEEE 802.1X: OSDX-EAP: getDecision: no identity known yet -> CONTINUE
Sep 16 14:34:37.565411 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 35)
Sep 16 14:34:40.568376 osdx hostapd[89157]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Sending EAP Packet (identifier 35)

Test Reauth Period In MAB-First Mode

Description

This scenario shows how to configure the reauthentication period in a device with MAB/802.1X authentication.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth1 address 192.168.100.1/24
set interfaces ethernet eth1 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth1 authenticator aaa authentication list1
set interfaces ethernet eth1 authenticator log-level debug
set interfaces ethernet eth1 authenticator mode MAB-802.1x
set interfaces ethernet eth1 authenticator quiet-period 60
set interfaces ethernet eth1 authenticator reauth-period 20
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18uKSn7sRHMziGHPpn/C0zboDL9ydW/ptW5W8pkQq03jURzM1QDgwB10EJbgdayU5t4EBPSDLIH8A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping the IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.297 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.297/0.297/0.297/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

MAB: station successfully authenticated
Show output
Sep 16 14:34:48.686671 osdx hostapd[89816]: eth1: IEEE 802.11 Fetching hardware channel/rate support not supported.
Sep 16 14:34:48.686688 osdx hostapd[89816]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:34:48.686989 osdx hostapd[89816]: connect[radius]: Network is unreachable
Sep 16 14:34:48.686731 osdx hostapd[89816]: eth1: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-first, eap_server=0, eap_quiet_period=60, eap_max_retrans=2, mab_timeout=30
Sep 16 14:34:48.686740 osdx hostapd[89816]: eth1: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Sep 16 14:34:48.702445 osdx hostapd[89816]: Discovery mode enabled on eth1
Sep 16 14:34:48.702447 osdx hostapd[89816]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: enabling transmission of periodic EAP-Request frames
Sep 16 14:34:48.702551 osdx hostapd[89816]: eth1: interface state UNINITIALIZED->ENABLED
Sep 16 14:34:48.702551 osdx hostapd[89816]: eth1: AP-ENABLED
Sep 16 14:34:52.205855 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:53.704820 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 DRIVER: Device discovered, triggering MAB authentication
Sep 16 14:34:53.704857 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: New STA de:ad:be:ef:6c:11 added
Sep 16 14:34:53.704865 osdx hostapd[89817]: eth1: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Sep 16 14:34:53.722494 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB-first mode: Starting MAB authentication
Sep 16 14:34:53.722532 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query
Sep 16 14:34:53.722547 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11
Sep 16 14:34:53.724247 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11
Sep 16 14:34:53.724257 osdx hostapd[89817]: eth1: RADIUS Authentication server 10.215.168.1:1812
Sep 16 14:34:53.724328 osdx hostapd[89817]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:34:53.724356 osdx hostapd[89817]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:34:53.724404 osdx hostapd[89817]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Sending EAP-Request/Identity frame
Sep 16 14:34:53.724414 osdx hostapd[89817]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Next EAP-Request/Identity retransmit in 20 seconds
Sep 16 14:34:53.724641 osdx hostapd[89817]: eth1: RADIUS Received 20 bytes from RADIUS server
Sep 16 14:34:53.724648 osdx hostapd[89817]: eth1: RADIUS Received RADIUS message
Sep 16 14:34:53.724652 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:34:53.724656 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response
Sep 16 14:34:53.724673 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:11'
Sep 16 14:34:53.724693 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated
Sep 16 14:34:53.724697 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds)
Sep 16 14:34:53.724699 osdx hostapd[89817]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled
Sep 16 14:34:53.724712 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:34:53.724714 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session ED9747009123166C

Step 5: Run the command system journal show | grep "osdx hostapd" on DUT0 and check whether the output contains the following tokens:

IEEE 802.1X: Re-authentication period expired
Show output
Sep 16 14:34:56.746875 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:34:59.918482 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:35:03.141716 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:35:06.304201 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:35:09.490086 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:35:12.714046 osdx OSDxCLI[5354]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Sep 16 14:35:13.724854 osdx hostapd[89817]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Sending EAP-Request/Identity frame
Sep 16 14:35:13.724882 osdx hostapd[89817]: eth1: STA 01:80:c2:00:00:03 IEEE 802.1X: Next EAP-Request/Identity retransmit in 20 seconds
Sep 16 14:35:13.738852 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: Re-authentication period expired (20 seconds), triggering re-authentication
Sep 16 14:35:13.738866 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Starting RADIUS query
Sep 16 14:35:13.738912 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:11
Sep 16 14:35:13.738943 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:11
Sep 16 14:35:13.738968 osdx hostapd[89817]: eth1: RADIUS Sending RADIUS message to authentication server
Sep 16 14:35:13.739007 osdx hostapd[89817]: eth1: RADIUS Next RADIUS client retransmit in 1 seconds
Sep 16 14:35:13.739301 osdx hostapd[89817]: eth1: RADIUS Received 20 bytes from RADIUS server
Sep 16 14:35:13.739309 osdx hostapd[89817]: eth1: RADIUS Received RADIUS message
Sep 16 14:35:13.739314 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Sep 16 14:35:13.739319 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Processing RADIUS response
Sep 16 14:35:13.739358 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: station successfully authenticated
Sep 16 14:35:13.739362 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: MAB: Re-authentication enabled (next reauth in 20 seconds)
Sep 16 14:35:13.739366 osdx hostapd[89817]: eth1: IEEE 802.1X IEEE 802.1X: Discovery already disabled
Sep 16 14:35:13.739370 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 IEEE 802.1X: authorizing port
Sep 16 14:35:13.739374 osdx hostapd[89817]: eth1: STA de:ad:be:ef:6c:11 RADIUS: starting accounting session ED9747009123166C