Radius Terminate Capture

These scenarios show different acct-terminate-causes that are sent by OSDx devices when 802.1x sessions end.

../../../../../../../_images/causes.svg

Test 802.1x User Request Cause

Description

This scenario shows how to stop an 802.1x session using operational command supplicant disconnect. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=1.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+8ntL+l+6DNoNWdrEafqFODqpfXXv35x3l8p7q2nolAhxPMOwFeCVkcFqOj9uit6wIFzv6U8Z1Sw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.572 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.572/0.572/0.572/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX18v/oIJr7nfE4zYI/fMS8IYdmR50m62p+g=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.334 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.334/0.334/0.334/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x supplicant disconnect at DUT1 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:06:29.383988 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 59543, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.54752 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xa05c!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 527a65c61d0a157c03c75bba85d53245
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: A405F4EFD8D3CA73
            0x0000:  4134 3035 4634 4546 4438 4433 4341 3733
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Tue Nov 25 14:06:29 2025
            0x0000:  6925 b7e5
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: User Request
            0x0000:  0000 0001
1 packet captured

Test 802.1x Lost Carrier Cause

Description

This scenario shows how an 802.1x session is stopped after a link down event in DUT0 eth1. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=2.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX1/Att/L4RsPl1f0gAGFBIOsL6EWvXLY8D8=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/cPCYlbrrItwPL1BaRWy35OwXMhzD8HE4eEZaU8GiJwBYx9E2R7qzDWrpM+G1l7eLPKbMqGVRVAA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.561 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.561/0.561/0.561/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1/eN4XUARhNcQjJNW2lZLCekRkCIGTIwbQ=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.330 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.330/0.330/0.330/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Remove the link between DUT0 and DUT1 to provoke a link-down event.

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:06:42.479298 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 33334, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.53488 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x2860!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: b6e952460a925ac9722b23185e493c56
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: A2AC6771803163A2
            0x0000:  4132 4143 3637 3731 3830 3331 3633 4132
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Tue Nov 25 14:06:42 2025
            0x0000:  6925 b7f2
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Lost Carrier
            0x0000:  0000 0002
1 packet captured

Test 802.1x Idle Timeout Cause

Description

This scenario shows how an 802.1x session is stopped after a reauthentication timeout. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=4.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator max-retransmissions 2
set interfaces ethernet eth1 802.1x authenticator reauth-period 15
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/rTkgkKb91tAMGHbqfTTGzF+jrYmndKuaXfF2+ZSCJQjpVpggdpA6qgfNNuXVCMwuPKsPrmSFQFw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.611 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.611/0.611/0.611/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX1+pKKSfk05jdt0vTYeLFK0f+TJlUPEDyoA=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate               TRUE
Reauthenticate Period          15
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.386 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.386/0.386/0.386/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Disable DUT1 interface or remove address configuration to prevent the device from responding EAP requests.

Step 9: Modify the following configuration lines in DUT1 :

set interfaces ethernet eth1 disable

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:07:35.897835 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 47607, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.49069 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0xafa1!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: ca332a3d7708e6cf2394837f2ba08b4e
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: DA796749D492EAB6
            0x0000:  4441 3739 3637 3439 4434 3932 4541 4236
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Tue Nov 25 14:07:35 2025
            0x0000:  6925 b827
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 41 secs
            0x0000:  0000 0029
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Idle Timeout
            0x0000:  0000 0004
1 packet captured

Test 802.1x Admin Reset Cause

Description

This scenario shows how to stop an 802.1x session using operational command authenticator disassociate. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19LQ+KYTOst1ymIcsJxkxKwAm7h2dvoRz9A6EUBq4SmsiWI/hyt98IbcejTWKFcSbZz0u0N5dit1w==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.690 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.690/0.690/0.690/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX18zlI0I4LZuf6812jbIpviFMyma65615kk=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.374 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.374/0.374/0.374/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 9: Run command interfaces ethernet eth1 802.1x authenticator disassociate at DUT0 and expect this output:

Show output
OK

Step 10: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:07:49.678161 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 11560, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.33094 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x98c2!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: eb77e28e9c24a468ae10bdd31fa06875
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: EABB92B5D4E36AD9
            0x0000:  4541 4242 3932 4235 4434 4533 3641 4439
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Tue Nov 25 14:07:48 2025
            0x0000:  6925 b834
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test 802.1x NAS Request Cause

Description

This scenario shows how to stop an 802.1x session from the authentication server using a CoA message. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=10.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 192.168.200.1/24
set interfaces ethernet eth1 address 10.215.168.64/24
set interfaces ethernet eth1 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth1 traffic nat source rule 1 address masquerade
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 192.168.200.2/24
set interfaces ethernet eth1 802.1x authenticator aaa accounting list1
set interfaces ethernet eth1 802.1x authenticator aaa authentication list1
set interfaces ethernet eth1 802.1x authenticator coa client 10.215.168.1
set interfaces ethernet eth1 802.1x authenticator coa encrypted-secret U2FsdGVkX19CWKcJLL8tWgl6/bysCcnF7DAez7lv3f4=
set interfaces ethernet eth1 802.1x authenticator reauth-period 0
set interfaces ethernet eth1 address 192.168.100.1/24
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+uvITGcVf2lgsXW42lJe85ySGx45aiiYd00hZGMYM1ULOgkrG35xQqTojxvi9XaMGwYcFVl78ctg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 3: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.658 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.658/0.658/0.658/0.000 ms

Step 4: Set the following configuration in DUT1 :

set interfaces ethernet eth1 802.1x supplicant encrypted-password U2FsdGVkX19rcc10iHW/NjNe9YsXlLyWiCsARB95ooM=
set interfaces ethernet eth1 802.1x supplicant username testing
set interfaces ethernet eth1 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 5: Run command interfaces ethernet eth1 802.1x supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 6: Run command interfaces ethernet eth1 802.1x supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 7: Run command interfaces ethernet eth1 802.1x authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Show output
---------------------------------
         Field             Value
---------------------------------
Access Challenges               9
Authentication Backend     RADIUS
Authentication Failures         0
Authentication Successes        1
EAPoL frames (Rx)              11
EAPoL frames (Tx)              11
Reauthenticate              FALSE
Reauthenticate Period           0
Session Time                    0
Session User Name         testing

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.405 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.405/0.405/0.405/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Send a CoA/Disconnect request from the RADIUS server On Linux, the FreeRADIUS package includes the utility radtest that can be used to send these messages:

Show output
$ cat /osdx-tests/utils/dot1x/auth.req
User-Name = "testing"
$ radclient -s -t 1 -r 1 10.215.168.64:3799 disconnect coa_secret -f /osdx-tests/utils/dot1x/auth.req
Sent Disconnect-Request Id 116 from 0.0.0.0:36385 to 10.215.168.64:3799 length 29
Received Disconnect-ACK Id 116 from 10.215.168.64:3799 to 10.215.168.1:36385 length 44
Packet summary:
      Accepted      : 1
      Rejected      : 0
      Lost          : 0
      Passed filter : 1
      Failed filter : 0

Step 9: Run command interfaces ethernet eth1 802.1x authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
14:08:03.192026 de:ad:be:ef:6c:00 > de:ad:be:ef:6c:20, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 64, id 25350, offset 0, flags [none], proto UDP (17), length 181)
    192.168.200.2.43277 > 10.215.168.1.1813: [bad udp cksum 0x3c36 -> 0x856c!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 3f849fbe98e85d7424da032e64dd9baa
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-01:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  313a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-11
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  31
          Acct-Session-Id Attribute (44), length: 18, Value: B221E6874AA8E877
            0x0000:  4232 3231 4536 3837 3441 4138 4538 3737
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth1
            0x0000:  6574 6831
          Event-Timestamp Attribute (55), length: 6, Value: Tue Nov 25 14:08:03 2025
            0x0000:  6925 b843
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: NAS Request
            0x0000:  0000 000a
1 packet captured