Radius Capture

This scenario shows how to capture and filter RADIUS messages after 802.1x authentication.

Test 802.1x RADIUS Station-ID

Description

DUT0 is configured with an 802.1x authenticated interface and DUT1 acts as an 802.1x supplicant. RADIUS messages are captured in DUT0 to check if Station-Id attributes are included.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19QPHWXzTEaAtBOJdf8WahJb1MTCKcBHr6GP8Iom3s0FMCLwJH5A2z7L5MlW35BZ0gvZdvnmy+7Jg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1

Note

Start packet capture in DUT0 to filter RADIUS messages

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1+/vCLpqyyhIZI5nu9rDPH3fbdhMAQBrEw=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized

Step 5: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1

Note

Stop packet capture in DUT0 and expect the following RADIUS messages: