Radius Terminate Capture

These scenarios show different acct-terminate-causes that are sent by OSDx devices when 802.1x sessions end.

../../../../../../_images/causes.svg

Test 802.1x User Request Cause

Description

This scenario shows how to stop an 802.1x session using operational command supplicant disconnect. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=1.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.225 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.225/0.225/0.225/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+n0XXN1cO7ziM8U/RbHTIqP3nzO7VfTH+JjOWe8Wzi8a5zLo91EPyOWIt8+4qphJ5MViwimXeLDw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.367 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.367/0.367/0.367/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX18fR9yI3ySmm3SX65TLmSIuDkk9z7wxjqY=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.399 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.399/0.399/0.399/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 10: Run command interfaces ethernet eth2 supplicant disconnect at DUT1 and expect this output:

Show output
OK

Step 11: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:04:48.432188 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 29746, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.37980 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0x73c0!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 79db34a599cbce676ad8c5910c3ba3a5
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 5424E1AC1E6653E0
            0x0000:  3534 3234 4531 4143 3145 3636 3533 4530
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:04:48 2026
            0x0000:  6978 d410
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: User Request
            0x0000:  0000 0001
1 packet captured

Test 802.1x Lost Carrier Cause

Description

This scenario shows how an 802.1x session is stopped after a link down event in DUT0 eth2. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=2.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.231 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.231/0.231/0.231/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator coa client 10.215.168.1
set interfaces ethernet eth2 authenticator coa encrypted-secret U2FsdGVkX1+p9lLFBOKqzXf/xf7pURCjlllQLcQvWhU=
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19A0nGI3DW1DMOYRKVj0iEpmZtygPUtxDHQjd1thHwsELi+2EsSjlwzpW7zIHmL3n0RvhzA7AplYw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.430 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.430/0.430/0.430/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1/3iY/Y+PBKKccjbYf4WiQK8p61D8TnhMA=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.407 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.407/0.407/0.407/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Remove the link between DUT0 and DUT1 to provoke a link-down event.

Step 10: Run command interfaces ethernet eth2 authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:05:02.043769 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 64349, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.55970 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0xa18b!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: f31caf2ff44f55de80d186a3a319d189
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 0CFF8AAE1C08DFDD
            0x0000:  3043 4646 3841 4145 3143 3038 4446 4444
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:05:02 2026
            0x0000:  6978 d41e
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Lost Carrier
            0x0000:  0000 0002
1 packet captured

Test MAB Lost Carrier Cause

Description

This scenario shows how a MAB authenticated session is stopped after a link down event in DUT0 eth2. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=2.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.189 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.189/0.189/0.189/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator coa client 10.215.168.1
set interfaces ethernet eth2 authenticator coa encrypted-secret U2FsdGVkX1/IAJ5cqpVGttYHzfgP3E6Wz5qa9dkCSiU=
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-MAB
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/Al5ESk6x/V45DVAEhmn4WcnurSXV/FFpaBcG6JKBaCssLVGFdmogxNzW7SiGRBMLGI5pKqVHt8A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.442 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.442/0.442/0.442/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.407 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.407/0.407/0.407/0.000 ms

Step 7: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+MAB
Show output
-------------------------------------------
         Field                  Value
-------------------------------------------
Access Challenges                         0
Authentication Backend               RADIUS
Authentication Failures                   0
Authentication Mode                     MAB
Authentication Status      Authorized (MAB)
Authentication Successes                  1
EAPoL frames (Rx)                         0
EAPoL frames (Tx)                         0
Quiet Period                             60
Reauthenticate                        FALSE
Reauthenticate Period                     0
Session Time                              4
Session User MAC          de:ad:be:ef:6c:12
Session User Name                       N/A

Step 8: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.658 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.658/0.658/0.658/0.000 ms

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.609 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.609/0.609/0.609/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Remove the link between DUT0 and DUT1 to provoke a link-down event.

Step 10: Run command interfaces ethernet eth2 authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:05:22.765324 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 205: (tos 0x0, ttl 63, id 14037, offset 0, flags [none], proto UDP (17), length 191)
    10.215.168.66.47178 > 10.215.168.1.1813: [bad udp cksum 0x66ae -> 0xa4ac!] RADIUS, length: 163
        Accounting-Request (4), id: 0x02, Authenticator: 8ef828870d3e34b15a395d2b1758b485
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: Local
            0x0000:  0000 0002
          User-Name Attribute (1), length: 19, Value: de:ad:be:ef:6c:12
            0x0000:  6465 3a61 643a 6265 3a65 663a 3663 3a31
            0x0010:  32
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: F3127C625388DFF1
            0x0000:  4633 3132 3743 3632 3533 3838 4446 4631
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:05:23 2026
            0x0000:  6978 d433
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 04 secs
            0x0000:  0000 0004
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Lost Carrier
            0x0000:  0000 0002
1 packet captured

Test 802.1x Idle Timeout Cause

Description

This scenario shows how an 802.1x session is stopped after a reauthentication timeout. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=4.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.253 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.253/0.253/0.253/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 30
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19Ycvm8XgwBYXT47kynmsx27vM0oVjAN8GQCqatA2E2gdIj87+8LFw1UHRRnfaJK4OD2gn2V6oT+Q==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.449 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.449/0.449/0.449/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1/uvw8nFzOkauaL+EV6lNIh5Z/rXsyhUp0=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                           TRUE
Reauthenticate Period                      30
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.297 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.297/0.297/0.297/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Disable DUT1 interface or remove address configuration to prevent the device from responding EAP requests.

Step 10: Modify the following configuration lines in DUT1 :

set interfaces ethernet eth2 disable

Step 11: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:06:30.607579 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 14216, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.35251 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0x5070!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: a2b9da279aa29e88f67f0e9af93ba092
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 6CEC52C9B5E2D1D3
            0x0000:  3643 4543 3532 4339 4235 4532 4431 4433
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:06:30 2026
            0x0000:  6978 d476
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 51 secs
            0x0000:  0000 0033
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Idle Timeout
            0x0000:  0000 0004
1 packet captured

Test 802.1x Admin Reset Cause

Description

This scenario shows how to stop an 802.1x session using operational command authenticator disassociate. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.204 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.204/0.204/0.204/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/u8JaApCk+z4iDUD7QqlNXfjsxtrzSIUTYTZ9dPrCfZsMWeWdRjlKdH/M3Oef0jar4YVCvN37VoQ==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.381 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.381/0.381/0.381/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX19ivNbE/tHDtvC9fVuXjxkSI1o/sYMumMk=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.416 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.416/0.416/0.416/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 10: Run command interfaces ethernet eth2 authenticator disassociate at DUT0 and expect this output:

Show output
OK

Step 11: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:06:46.223919 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 52216, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.33247 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0x6357!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 9a7b5abac79ec956172dc87f3993f95a
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: B1EE827A1D724FB3
            0x0000:  4231 4545 3832 3741 3144 3732 3446 4233
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:06:46 2026
            0x0000:  6978 d486
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test MAB Admin Reset Cause

Description

This scenario shows how to stop a MAB authenticated session using operational command authenticator disassociate. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.186 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.186/0.186/0.186/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-MAB
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/BeIOLkl4zIuDzpHnJvEF00ZTpNHz8RKVj445+dnMghHmJeldeBwMnPFBZAINd7cxfJa6UzShD1A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.426 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.426/0.426/0.426/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.256 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.256/0.256/0.256/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 7: Run command interfaces ethernet eth2 authenticator disassociate at DUT0 and expect this output:

Show output
OK

Step 8: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:07:02.783601 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 205: (tos 0x0, ttl 63, id 27404, offset 0, flags [none], proto UDP (17), length 191)
    10.215.168.66.57197 > 10.215.168.1.1813: [bad udp cksum 0x66ae -> 0x0c93!] RADIUS, length: 163
        Accounting-Request (4), id: 0x02, Authenticator: 0d750aba24930726af39e4788dd51a0e
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: Local
            0x0000:  0000 0002
          User-Name Attribute (1), length: 19, Value: de:ad:be:ef:6c:12
            0x0000:  6465 3a61 643a 6265 3a65 663a 3663 3a31
            0x0010:  32
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 5FE9C4D7896E1EF8
            0x0000:  3546 4539 4334 4437 3839 3645 3145 4638
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:07:02 2026
            0x0000:  6978 d496
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test 802.1x Admin Restart Cause

Description

This scenario shows how to restart an 802.1x session using operational command authenticator restart. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.231 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.231/0.231/0.231/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19fef1vMxOqg7y6f7+TGa5W3wu3tky//htvKSBz0Z6Khdfz1Q/ikT+AclRZE7kMXZ5vZcwqrPZ+GQ==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.433 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.433/0.433/0.433/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX19ZY+A2O7nEQlv7xVG3Amo69H72qps412Q=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.367 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.367/0.367/0.367/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 10: Run command interfaces ethernet eth2 authenticator restart at DUT0 and expect this output: Step 11: Run command interfaces ethernet eth2 authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:07:17.705016 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 40959, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.39384 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0xc17f!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: 858c2a715ce5a6b70571a9e6579a5107
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: C9EF9F717A7B2947
            0x0000:  4339 4546 3946 3731 3741 3742 3239 3437
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:07:17 2026
            0x0000:  6978 d4a5
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test MAB Admin Restart Cause

Description

This scenario shows how to restart a MAB authenticated session using operational command authenticator restart. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=6.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.204 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.204/0.204/0.204/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-MAB
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1/Be1Y4PHYWJbMvaAplzhtBIpa1vAznaBv4kAP5fVh2YgMFn2TbfkyzBdI6HAReXamCDiyMMKbPdQ==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.384 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.384/0.384/0.384/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.255 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.255/0.255/0.255/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Step 7: Run command interfaces ethernet eth2 authenticator restart at DUT0 and expect this output: Step 8: Run command interfaces ethernet eth2 authenticator show status at DUT0 and expect this output:

Show output
Error: no supplicant found
  CLI Error: Command error

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:07:34.332322 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 205: (tos 0x0, ttl 63, id 20883, offset 0, flags [none], proto UDP (17), length 191)
    10.215.168.66.37246 > 10.215.168.1.1813: [bad udp cksum 0x66ae -> 0xe81e!] RADIUS, length: 163
        Accounting-Request (4), id: 0x02, Authenticator: 8a5f8483da0b6fa211606e14cbac4433
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: Local
            0x0000:  0000 0002
          User-Name Attribute (1), length: 19, Value: de:ad:be:ef:6c:12
            0x0000:  6465 3a61 643a 6265 3a65 663a 3663 3a31
            0x0010:  32
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 8D5381FB663ECF96
            0x0000:  3844 3533 3831 4642 3636 3345 4346 3936
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:07:33 2026
            0x0000:  6978 d4b5
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 01 secs
            0x0000:  0000 0001
          Acct-Terminate-Cause Attribute (49), length: 6, Value: Admin Reset
            0x0000:  0000 0006
1 packet captured

Test 802.1x NAS Request Cause

Description

This scenario shows how to stop an 802.1x session from the authentication server using a CoA message. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=10.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.205 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.205/0.205/0.205/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator coa client 10.215.168.1
set interfaces ethernet eth2 authenticator coa encrypted-secret U2FsdGVkX1/HJf4g9TZ1CwJLwmHvExvcFn3Rx9A8VAY=
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX1+6XgY9EdWYF1wtMkvBUs0FohnCrgNN5RTCGbBvUCsHualdujs7E/W2/PvA1J4O4XHtRTTt24FshA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.371 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.371/0.371/0.371/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1+SAbQvKgDUEYDT5MD4jxxtV8XvwcuyNH8=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 7: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 8: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 9: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.342 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.342/0.342/0.342/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Send a CoA/Disconnect request from the RADIUS server On Linux, the FreeRADIUS package includes the utility radtest that can be used to send these messages:

Show output
$ cat /osdx-tests/utils/dot1x/auth_dot1x.req
User-Name = "testing"
$ radclient -s -t 1 -r 1 10.215.168.66:3799 disconnect coa_secret -f /osdx-tests/utils/dot1x/auth_dot1x.req
Sent Disconnect-Request Id 185 from 0.0.0.0:54709 to 10.215.168.66:3799 length 29
Received Disconnect-ACK Id 185 from 10.215.168.66:3799 to 10.215.168.1:54709 length 44
Packet summary:
      Accepted      : 1
      Rejected      : 0
      Lost          : 0
      Passed filter : 1
      Failed filter : 0

Step 10: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:07:47.243223 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 195: (tos 0x0, ttl 63, id 30621, offset 0, flags [none], proto UDP (17), length 181)
    10.215.168.66.42273 > 10.215.168.1.1813: [bad udp cksum 0x66a4 -> 0xe918!] RADIUS, length: 153
        Accounting-Request (4), id: 0x0c, Authenticator: f41892d8f2f21a318fca4d2e679ebd41
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: RADIUS
            0x0000:  0000 0001
          User-Name Attribute (1), length: 9, Value: testing
            0x0000:  7465 7374 696e 67
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 60D8F89442F251EC
            0x0000:  3630 4438 4638 3934 3432 4632 3531 4543
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:07:47 2026
            0x0000:  6978 d4c3
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: NAS Request
            0x0000:  0000 000a
1 packet captured

Test MAB NAS Request Cause

Description

This scenario shows how to stop a MAB authenticated session from the authentication server using a CoA message. Accounting RADIUS stop messages should contain the following attribute: acct-terminate-cause=10.

Scenario

Step 1: Set the following configuration in DUT2 :

set interfaces ethernet eth0 address 10.215.168.66/24
set interfaces ethernet eth0 traffic nat destination rule 1 address 192.168.200.2
set interfaces ethernet eth0 traffic nat source rule 1 address masquerade
set interfaces ethernet eth1 address 192.168.200.1/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT2:

admin@DUT2$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.217 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.217/0.217/0.217/0.000 ms

Step 3: Set the following configuration in DUT0 :

set interfaces ethernet eth1 address 192.168.200.2/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator aaa accounting list1
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator coa client 10.215.168.1
set interfaces ethernet eth2 authenticator coa encrypted-secret U2FsdGVkX19AU0Sf2Ine/7Z+r7gFb1NiXhuvs3xAm18=
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-MAB
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set protocols static route 0.0.0.0/0 next-hop 192.168.200.1
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18KQ76xUI5ADniF8xihNXlxqgyPgW0aMHACyH4CXwlVY5/yKnAzM3K/8V0dxW1d2XWd2XlqFAFdCw==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=63 time=0.484 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.484/0.484/0.484/0.000 ms

Step 5: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 6: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.232 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.232/0.232/0.232/0.000 ms

Note

Start packet capture in DUT2 to filter RADIUS stop messages (e.g., traffic dump monitor interface eth0 detail filter "udp port 1813" packets 1).

Note

Send a CoA/Disconnect request from the RADIUS server On Linux, the FreeRADIUS package includes the utility radtest that can be used to send these messages:

Show output
$ cat /osdx-tests/utils/dot1x/auth_mab.req
User-Name = "de:ad:be:ef:6c:12"
$ radclient -s -t 1 -r 1 10.215.168.66:3799 disconnect coa_secret -f /osdx-tests/utils/dot1x/auth_mab.req
Sent Disconnect-Request Id 207 from 0.0.0.0:56485 to 10.215.168.66:3799 length 39
Received Disconnect-ACK Id 207 from 10.215.168.66:3799 to 10.215.168.1:56485 length 44
Packet summary:
      Accepted      : 1
      Rejected      : 0
      Lost          : 0
      Passed filter : 1
      Failed filter : 0

Step 7: Run command interfaces ethernet eth2 authenticator show status at DUT0 and check if output contains the following tokens:

Current status: Unauthorized
Show output
Current status: Unauthorized

Note

Stop packet capture in DUT0 and expect the following RADIUS messages:

Show output
 eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
15:08:02.900978 de:ad:be:ef:6c:20 > fe:3e:56:c2:cd:ff, ethertype IPv4 (0x0800), length 205: (tos 0x0, ttl 63, id 48376, offset 0, flags [none], proto UDP (17), length 191)
    10.215.168.66.46430 > 10.215.168.1.1813: [bad udp cksum 0x66ae -> 0xe237!] RADIUS, length: 163
        Accounting-Request (4), id: 0x02, Authenticator: ade7860d3612ae3eb83734862f95703d
          Acct-Status-Type Attribute (40), length: 6, Value: Stop
            0x0000:  0000 0002
          Acct-Authentic Attribute (45), length: 6, Value: Local
            0x0000:  0000 0002
          User-Name Attribute (1), length: 19, Value: de:ad:be:ef:6c:12
            0x0000:  6465 3a61 643a 6265 3a65 663a 3663 3a31
            0x0010:  32
          Called-Station-Id Attribute (30), length: 20, Value: DE-AD-BE-EF-6C-02:
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d30
            0x0010:  323a
          Service-Type Attribute (6), length: 6, Value: Framed
            0x0000:  0000 0002
          Calling-Station-Id Attribute (31), length: 19, Value: DE-AD-BE-EF-6C-12
            0x0000:  4445 2d41 442d 4245 2d45 462d 3643 2d31
            0x0010:  32
          Acct-Session-Id Attribute (44), length: 18, Value: 6AF7BD886EBB4F36
            0x0000:  3641 4637 4244 3838 3645 4242 3446 3336
          NAS-Port-Type Attribute (61), length: 6, Value: Ethernet
            0x0000:  0000 000f
          Connect-Info Attribute (77), length: 13, Value: Unsupported
            0x0000:  556e 7375 7070 6f72 7465 64
          NAS-Port-Id Attribute (87), length: 6, Value: eth2
            0x0000:  6574 6832
          Event-Timestamp Attribute (55), length: 6, Value: Tue Jan 27 15:08:02 2026
            0x0000:  6978 d4d2
          Acct-Delay-Time Attribute (41), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Session-Time Attribute (46), length: 6, Value: 00 secs
            0x0000:  0000 0000
          Acct-Terminate-Cause Attribute (49), length: 6, Value: NAS Request
            0x0000:  0000 000a
1 packet captured