Radius Terminate Capture

These scenarios show different acct-terminate-causes that are sent by OSDx devices when 802.1x sessions end.

../../../../../../../_images/causes.svg

Test 802.1x User Request Cause

Description

This scenario shows how to stop an 802.1x session using operational command supplicant disconnect. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=1.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/1ZZvYmrB88p+81Q7wFOB1bUptU+bbs0GZn+1Z/O+66+rrd6OKMNvoxES5ELk75uMtEace4ZRlpg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.415 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.415/0.415/0.415/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1/qN0yvqRtkmyFpkkJASKkTd8Y4eE9oD6A=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.504 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.504/0.504/0.504/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x supplicant disconnect at DUT1 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:23:40.707308 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 46816, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.38800 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xe633!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 0db070715e4cf6fac65fae700ff68bb5
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: 436E2972CA419529
            0x0000:  3433 3645 3239 3732 4341 3431 3935 3239
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Mar 10 09:23:40 2025
            0x0000:  67ce af9c
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: User Request
            0x0000:  0000 0001
1 packet captured

Test 802.1x Lost Carrier Cause

Description

This scenario shows how an 802.1x session is stopped after a link down event in DUT0 eth1. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=2.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX18zK3Y0A0KUAB4lNEP/UHX0DhdVgWUIEio=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+1HfOMZM7OLv2XJlDzidkZT+aLLh+xPiKxO35Zuc6X0vPG5lYvYegI9KIpbmpNsxKvt8OynB9Byg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.420 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.420/0.420/0.420/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX195D9YfRn+FzefPmKV56hc9Wy2m3SVMyBQ=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.344 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.344/0.344/0.344/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Remove the link between DUT0 and DUT1 to provoke a link-down event.

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:23:59.819507 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 53132, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.54685 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xd977!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 995c88aa3bb3e7f3d275774b121ec4fd
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: A7EC8AB39CD37087
            0x0000:  4137 4543 3841 4233 3943 4433 3730 3837
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Mar 10 09:24:00 2025
            0x0000:  67ce afb0
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Lost Carrier
            0x0000:  0000 0002
1 packet captured

Test 802.1x Idle Timeout Cause

Description

This scenario shows how an 802.1x session is stopped after a reauthentication timeout. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=4.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator max-retransmissions 2
set interfaces ethernet eth1 802.1x authenticator reauth-period 15
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19YNt8G06ULtGKmIG3htZy64EIbw2yS09uO2CThv43V6zbRx4ymMjHx2QvXcxd4yYyxIYbPZiu3QA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.530 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.530/0.530/0.530/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX18DSViMINFkOaJJgRFWW3SDo2dX8Yld+zs=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate               TRUE
Reauthenticate Period          15
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.325 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.325/0.325/0.325/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Disable DUT1 interface or remove address configuration to prevent the device from responding EAP requests.

Step 9: Modify the following configuration lines in DUT1 :

set interfaces ethernet eth1 disable

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:25:00.891046 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 32471, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.52837 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x6a46!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 7b194be066c9bc1d24eac3bd792f425d
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: B162AB31943267F7
            0x0000:  4231 3632 4142 3331 3934 3332 3637 4637
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Mar 10 09:25:00 2025
            0x0000:  67ce afec
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 41 secs
            0x0000:  0000 0029
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Idle Timeout
            0x0000:  0000 0004
1 packet captured

Test 802.1x Admin Reset Cause

Description

This scenario shows how to stop an 802.1x session using operational command authenticator disassociate. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+GFpW6wdvw2HP7WFlB7oY7Ig899IZ/GtuMrYNuFTnDaobdbjbBUBlPA30rz8HqRG0gbdkT5Fs+oA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.371 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.371/0.371/0.371/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1/CVtcgtilxhVfr1a6IIzrd33PRdJ3dt9M=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.330 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.330/0.330/0.330/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x authenticator disassociate at DUT0 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:25:14.428286 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 16107, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.59986 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x4759!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 3ea2200b6e9d935b433c8b759b5dc755
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: A3BB70DAC86072B4
            0x0000:  4133 4242 3730 4441 4338 3630 3732 4234
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Mar 10 09:25:14 2025
            0x0000:  67ce affa
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test 802.1x NAS Request Cause

Description

This scenario shows how to stop an 802.1x session from the authentication server using a CoA message. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=10.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX1/UzluBBFFw0Rz6rNhcE3E+K5QSMVbFCa0=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX198KJCDL11i5yAGqIy+k3Vc0CZvZNyvqTstY95uMhCvrhDA508ze81lId8DdAmvmdLP46b5T9JE0A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.434 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.434/0.434/0.434/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX19N9O057PwoyjN2DBIXjMOBSqoyYwsa9S8=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.371 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.371/0.371/0.371/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Send a CoA/Disconnect request from the RADIUS server On Linux, the FreeRADIUS package includes the utility radtest that can be used to send these messages:

Show output
$ cat /osdx-tests/utils/dot1x/auth.req
User-Name = "testing"
$ radclient -s -t 1 -r 1 10.215.168.64:3799 disconnect coa_secret -f /osdx-tests/utils/dot1x/auth.req
Sent Disconnect-Request Id 195 from 0.0.0.0:37652 to 10.215.168.64:3799 length 29
Received Disconnect-ACK Id 195 from 10.215.168.64:3799 to 10.215.168.1:37652 length 44
Packet summary:
      Accepted      : 1
      Rejected      : 0
      Lost          : 0
      Passed filter : 1
      Failed filter : 0

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
09:25:27.684164 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 424, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.55477 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x56c1!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 8c4c5d042aebf435f7c575098346a285
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: D55FAB70DF8F8846
            0x0000:  4435 3546 4142 3730 4446 3846 3838 3436
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Mon Mar 10 09:25:26 2025
            0x0000:  67ce b006
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: NAS Request
            0x0000:  0000 000a
1 packet captured