Only 802.1X

This scenario shows how to configure the only-802.1x authentication mode.

../../../../../_images/topologydut0dut1.svg

Test Successful 802.1x Authentication

Description

This scenario shows how to configure 802.1x-only authentication. DUT1 uses the correct username and password.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX18ZKwU2lukwwUqO3P+B8juB8kasveeeyiCQ+vNH9vP1MVxuc4MG0bw60//+jD/AN/jaO1CJCHcZ9A==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.167 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.167/0.167/0.167/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1+xv3hWYncrxPb/kVKXLoV3+znurKRIdmE=
set interfaces ethernet eth2 supplicant username testing
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:

Authorized
Show output
---------------------------------------------------
        Field                      Value
---------------------------------------------------
EAP State                                   SUCCESS
EAP TLS Cipher          ECDHE-RSA-AES256-GCM-SHA384
EAP TLS Version                             TLSv1.2
PAE State                             AUTHENTICATED
Supplicant Port Status                   Authorized
WPA State                                 COMPLETED

Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Authorized
Show output
-------------------------------
       Field           Value
-------------------------------
EAPoL Frames (Rx)            11
EAPoL Frames (Tx)            11
Invalid Frames (Rx)           0
Logoff Frames (Tx)            0
Port Status          Authorized
Req Frames (Rx)               9
Req ID Frames (Rx)            1
Resp Frames (Tx)             10
Start Frames (Tx)             1

Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Successes\s+1
Authentication Mode\s+802\.1X
Show output
---------------------------------------------
         Field                   Value
---------------------------------------------
Access Challenges                           9
Authentication Backend                 RADIUS
Authentication Failures                     0
Authentication Mode                    802.1X
Authentication Status     Authorized (802.1X)
Authentication Successes                    1
EAPoL frames (Rx)                          11
EAPoL frames (Tx)                          11
Quiet Period                               60
Reauthenticate                          FALSE
Reauthenticate Period                       0
Session Time                                0
Session User MAC            de:ad:be:ef:6c:12
Session User Name                     testing

Step 7: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.
64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.370 ms

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.370/0.370/0.370/0.000 ms

Step 8: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:

IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Show output
Mar 20 09:23:47.856757 osdx hostapd[104236]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported.
Mar 20 09:23:47.856770 osdx hostapd[104236]: eth2: RADIUS Authentication server 10.215.168.1:1812
Mar 20 09:23:47.857024 osdx hostapd[104236]: connect[radius]: Network is unreachable
Mar 20 09:23:47.856809 osdx hostapd[104236]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2
Mar 20 09:23:47.856812 osdx hostapd[104236]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Mar 20 09:23:47.884602 osdx hostapd[104236]: Discovery mode enabled on eth2
Mar 20 09:23:47.884649 osdx hostapd[104236]: eth2: interface state UNINITIALIZED->ENABLED
Mar 20 09:23:47.884649 osdx hostapd[104236]: eth2: AP-ENABLED
Mar 20 09:23:50.927411 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added
Mar 20 09:23:50.927425 osdx hostapd[104237]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Mar 20 09:23:50.956653 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication
Mar 20 09:23:50.956683 osdx hostapd[104237]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames
Mar 20 09:23:50.956700 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA
Mar 20 09:23:50.956709 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port
Mar 20 09:23:50.956716 osdx hostapd[104237]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Mar 20 09:23:50.956736 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 182)
Mar 20 09:23:50.957140 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=182 len=12) from STA: EAP Response-Identity (1)
Mar 20 09:23:50.957159 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'testing'
Mar 20 09:23:50.957189 osdx hostapd[104237]: eth2: RADIUS Authentication server 10.215.168.1:1812
Mar 20 09:23:50.959566 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.959599 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.959858 osdx hostapd[104237]: eth2: RADIUS Received 80 bytes from RADIUS server
Mar 20 09:23:50.959866 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.959871 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.959892 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=183 len=22) from RADIUS server: EAP-Request-MD5 (4)
Mar 20 09:23:50.959901 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 183)
Mar 20 09:23:50.960133 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=183 len=6) from STA: EAP Response-unknown (3)
Mar 20 09:23:50.960179 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.960191 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.960401 osdx hostapd[104237]: eth2: RADIUS Received 64 bytes from RADIUS server
Mar 20 09:23:50.960407 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.960411 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.960426 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=184 len=6) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.960432 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 184)
Mar 20 09:23:50.960800 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=184 len=194) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.960838 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.960850 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.962166 osdx hostapd[104237]: eth2: RADIUS Received 1068 bytes from RADIUS server
Mar 20 09:23:50.962172 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.962176 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.962195 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=185 len=1004) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.962202 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 185)
Mar 20 09:23:50.962372 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=185 len=6) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.962410 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.962420 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.962572 osdx hostapd[104237]: eth2: RADIUS Received 229 bytes from RADIUS server
Mar 20 09:23:50.962579 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.962583 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.962600 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=186 len=171) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.962607 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 186)
Mar 20 09:23:50.964029 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=186 len=103) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.964091 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.964109 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.964445 osdx hostapd[104237]: eth2: RADIUS Received 115 bytes from RADIUS server
Mar 20 09:23:50.964451 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.964456 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.964473 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=187 len=57) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.964480 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 187)
Mar 20 09:23:50.964765 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=187 len=6) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.964813 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.964827 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.964967 osdx hostapd[104237]: eth2: RADIUS Received 98 bytes from RADIUS server
Mar 20 09:23:50.964973 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.964977 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.965001 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=188 len=40) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.965007 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 188)
Mar 20 09:23:50.965177 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=188 len=43) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.965214 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.965224 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.965368 osdx hostapd[104237]: eth2: RADIUS Received 131 bytes from RADIUS server
Mar 20 09:23:50.965374 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.965378 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.965392 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=189 len=73) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.965398 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 189)
Mar 20 09:23:50.965659 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=189 len=97) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.965699 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.965714 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.965916 osdx hostapd[104237]: eth2: RADIUS Received 140 bytes from RADIUS server
Mar 20 09:23:50.965922 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.965926 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.965942 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=190 len=82) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.965948 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 190)
Mar 20 09:23:50.966182 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=190 len=37) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.966232 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.966248 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.966429 osdx hostapd[104237]: eth2: RADIUS Received 104 bytes from RADIUS server
Mar 20 09:23:50.966436 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.966441 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.966464 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=191 len=46) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:23:50.966472 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 191)
Mar 20 09:23:50.966663 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=191 len=46) from STA: EAP Response-PEAP (25)
Mar 20 09:23:50.966720 osdx hostapd[104237]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:23:50.966733 osdx hostapd[104237]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:23:50.966948 osdx hostapd[104237]: eth2: RADIUS Received 175 bytes from RADIUS server
Mar 20 09:23:50.966954 osdx hostapd[104237]: eth2: RADIUS Received RADIUS message
Mar 20 09:23:50.966959 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:23:50.966992 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing'
Mar 20 09:23:50.966998 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=3 id=191 len=4) from RADIUS server: EAP Success
Mar 20 09:23:50.967019 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 191)
Mar 20 09:23:50.967036 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authorizing port
Mar 20 09:23:50.967040 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 RADIUS: starting accounting session 9393C641C7AAC5BD
Mar 20 09:23:50.967044 osdx hostapd[104237]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)

Test Unsuccessful 802.1x Authentication

Description

This scenario shows how to configure 802.1x-only authentication. DUT1 uses an incorrect username.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19wCzIRo1klOGU7yMYbifkAFIHmcd2kQrXj26xlxw5JRm8GoJHDYrHrnpq621kkjR6tVdMi1Fw9Sg==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.260 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.260/0.260/0.260/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1/ybnU2oJOMEtF1myQrKwQi4XXpsrz9lCE=
set interfaces ethernet eth2 supplicant username wrong
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Unauthorized
Show output
---------------------------------
       Field            Value
---------------------------------
EAPoL Frames (Rx)               0
EAPoL Frames (Tx)               0
Invalid Frames (Rx)             0
Logoff Frames (Tx)              0
Port Status          Unauthorized
Req Frames (Rx)                 0
Req ID Frames (Rx)              0
Resp Frames (Tx)                0
Start Frames (Tx)               0

Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Unauthorized
Show output
---------------------------------
       Field            Value
---------------------------------
EAPoL Frames (Rx)               9
EAPoL Frames (Tx)              10
Invalid Frames (Rx)             0
Logoff Frames (Tx)              0
Port Status          Unauthorized
Req Frames (Rx)                 8
Req ID Frames (Rx)              1
Resp Frames (Tx)                9
Start Frames (Tx)               1

Step 6: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:

Port Status\s+Unauthorized
Show output
---------------------------------
       Field            Value
---------------------------------
EAPoL Frames (Rx)              10
EAPoL Frames (Tx)              10
Invalid Frames (Rx)             0
Logoff Frames (Tx)              0
Port Status          Unauthorized
Req Frames (Rx)                 8
Req ID Frames (Rx)              1
Resp Frames (Tx)                9
Start Frames (Tx)               1

Step 7: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

Authentication Failures\s+[1-9]\d?
Show output
-------------------------------------------
         Field                  Value
-------------------------------------------
Access Challenges                         8
Authentication Backend               RADIUS
Authentication Failures                   1
Authentication Mode                     N/A
Authentication Status          Unauthorized
Authentication Successes                  0
EAPoL frames (Rx)                        10
EAPoL frames (Tx)                        10
Quiet Period                             60
Reauthenticate                        FALSE
Reauthenticate Period                     0
Session Time                              0
Session User MAC          de:ad:be:ef:6c:12
Session User Name                       N/A

Step 8: Expect a failure in the following command: Ping IP address 192.168.100.1 from DUT1:

admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1
Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data.

--- 192.168.100.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

Step 9: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:

IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)
Show output
Mar 20 09:23:58.336691 osdx hostapd[104757]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported.
Mar 20 09:23:58.337495 osdx hostapd[104757]: connect[radius]: Network is unreachable
Mar 20 09:23:58.336710 osdx hostapd[104757]: eth2: RADIUS Authentication server 10.215.168.1:1812
Mar 20 09:23:58.336759 osdx hostapd[104757]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2
Mar 20 09:23:58.336764 osdx hostapd[104757]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Mar 20 09:23:58.352481 osdx hostapd[104757]: Discovery mode enabled on eth2
Mar 20 09:23:58.352570 osdx hostapd[104757]: eth2: interface state UNINITIALIZED->ENABLED
Mar 20 09:23:58.352570 osdx hostapd[104757]: eth2: AP-ENABLED
Mar 20 09:24:01.924231 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added
Mar 20 09:24:01.924243 osdx hostapd[104758]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Mar 20 09:24:01.944512 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication
Mar 20 09:24:01.944540 osdx hostapd[104758]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames
Mar 20 09:24:01.944556 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA
Mar 20 09:24:01.944564 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port
Mar 20 09:24:01.944571 osdx hostapd[104758]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Mar 20 09:24:01.944600 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 107)
Mar 20 09:24:01.944925 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=107 len=10) from STA: EAP Response-Identity (1)
Mar 20 09:24:01.944935 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'wrong'
Mar 20 09:24:01.944956 osdx hostapd[104758]: eth2: RADIUS Authentication server 10.215.168.1:1812
Mar 20 09:24:01.946796 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.946823 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.947096 osdx hostapd[104758]: eth2: RADIUS Received 80 bytes from RADIUS server
Mar 20 09:24:01.947101 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.947105 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.947122 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=108 len=22) from RADIUS server: EAP-Request-MD5 (4)
Mar 20 09:24:01.947129 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 108)
Mar 20 09:24:01.947407 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=108 len=6) from STA: EAP Response-unknown (3)
Mar 20 09:24:01.947470 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.947485 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.947672 osdx hostapd[104758]: eth2: RADIUS Received 64 bytes from RADIUS server
Mar 20 09:24:01.947677 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.947680 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.947697 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=109 len=6) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.947703 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 109)
Mar 20 09:24:01.948107 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=109 len=194) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.948157 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.948171 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.949475 osdx hostapd[104758]: eth2: RADIUS Received 1068 bytes from RADIUS server
Mar 20 09:24:01.949481 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.949485 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.949508 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=110 len=1004) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.949515 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 110)
Mar 20 09:24:01.949684 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=110 len=6) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.949721 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.949735 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.949864 osdx hostapd[104758]: eth2: RADIUS Received 229 bytes from RADIUS server
Mar 20 09:24:01.949869 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.949872 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.949893 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=111 len=171) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.949899 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 111)
Mar 20 09:24:01.951745 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=111 len=103) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.951789 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.951801 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.952121 osdx hostapd[104758]: eth2: RADIUS Received 115 bytes from RADIUS server
Mar 20 09:24:01.952128 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.952132 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.952152 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=112 len=57) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.952158 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 112)
Mar 20 09:24:01.952398 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=112 len=6) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.952453 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.952464 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.952601 osdx hostapd[104758]: eth2: RADIUS Received 98 bytes from RADIUS server
Mar 20 09:24:01.952607 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.952610 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.952624 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=113 len=40) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.952630 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 113)
Mar 20 09:24:01.952771 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=113 len=41) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.952804 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.952813 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.952973 osdx hostapd[104758]: eth2: RADIUS Received 131 bytes from RADIUS server
Mar 20 09:24:01.952978 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.952981 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.952993 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=114 len=73) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.952998 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 114)
Mar 20 09:24:01.953230 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=114 len=95) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.953261 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.953270 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:01.953436 osdx hostapd[104758]: eth2: RADIUS Received 104 bytes from RADIUS server
Mar 20 09:24:01.953441 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:01.953449 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:01.953461 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=115 len=46) from RADIUS server: EAP-Request-PEAP (25)
Mar 20 09:24:01.953466 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 115)
Mar 20 09:24:01.953651 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=115 len=46) from STA: EAP Response-PEAP (25)
Mar 20 09:24:01.953681 osdx hostapd[104758]: eth2: RADIUS Sending RADIUS message to authentication server
Mar 20 09:24:01.953691 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds
Mar 20 09:24:02.953784 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Resending RADIUS message (id=8)
Mar 20 09:24:02.953818 osdx hostapd[104758]: eth2: RADIUS Next RADIUS client retransmit in 2 seconds
Mar 20 09:24:02.954027 osdx hostapd[104758]: eth2: RADIUS Received 44 bytes from RADIUS server
Mar 20 09:24:02.954033 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:02.954038 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec
Mar 20 09:24:02.954093 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=4 id=115 len=4) from RADIUS server: EAP Failure
Mar 20 09:24:02.954123 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 115)
Mar 20 09:24:02.954193 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port
Mar 20 09:24:02.954198 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)
Mar 20 09:24:02.954202 osdx hostapd[104758]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds)
Mar 20 09:24:02.954208 osdx hostapd[104758]: eth2: RADIUS Received 44 bytes from RADIUS server
Mar 20 09:24:02.954215 osdx hostapd[104758]: eth2: RADIUS Received RADIUS message
Mar 20 09:24:02.954218 osdx hostapd[104758]: eth2: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet

Test Unsupported 802.1x Authentication

Description

This scenario shows how to configure 802.1x-only authentication. DUT1 does not support 802.1x authentication.

Scenario

Step 1: Set the following configuration in DUT0 :

set interfaces ethernet eth0 address 10.215.168.64/24
set interfaces ethernet eth2 address 192.168.100.1/24
set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2
set interfaces ethernet eth2 authenticator aaa authentication list1
set interfaces ethernet eth2 authenticator log-level debug
set interfaces ethernet eth2 authenticator mode only-802.1x
set interfaces ethernet eth2 authenticator quiet-period 60
set interfaces ethernet eth2 authenticator reauth-period 0
set system aaa group radius radgroup1 server serv1
set system aaa list list1 method 1 group radius radgroup1
set system aaa server radius serv1 address 10.215.168.1
set system aaa server radius serv1 encrypted-key U2FsdGVkX19vzaoit8hF40d/HJoVp7pJ0DHr9bf+Dj4h/2AQNc9rRw5LqFlK6AiVeM0JpLTLjOnTWyrs/C+OLA==
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 2: Ping IP address 10.215.168.1 from DUT0:

admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1
Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data.
64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.235 ms

--- 10.215.168.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.235/0.235/0.235/0.000 ms

Step 3: Set the following configuration in DUT1 :

set interfaces ethernet eth2 address 192.168.100.2/24
set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'

Step 4: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

EAPoL frames \(Rx\)\s+0
EAPoL frames \(Tx\)\s+[1-9]+[0-9]*
Show output
-------------------------------------------
         Field                  Value
-------------------------------------------
Access Challenges                         0
Authentication Backend               RADIUS
Authentication Failures                   0
Authentication Mode                     N/A
Authentication Status          Unauthorized
Authentication Successes                  0
EAPoL frames (Rx)                         0
EAPoL frames (Tx)                         2
Quiet Period                             60
Reauthenticate                        FALSE
Reauthenticate Period                     0
Session Time                              0
Session User MAC          de:ad:be:ef:6c:12
Session User Name                       N/A

Step 5: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

EAPoL frames \(Rx\)\s+0
EAPoL frames \(Tx\)\s+[1-9]+[0-9]*
Show output
-------------------------------------------
         Field                  Value
-------------------------------------------
Access Challenges                         0
Authentication Backend               RADIUS
Authentication Failures                   0
Authentication Mode                     N/A
Authentication Status          Unauthorized
Authentication Successes                  0
EAPoL frames (Rx)                         0
EAPoL frames (Tx)                         3
Quiet Period                             60
Reauthenticate                        FALSE
Reauthenticate Period                     0
Session Time                              0
Session User MAC          de:ad:be:ef:6c:12
Session User Name                       N/A

Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:

EAPoL frames \(Rx\)\s+0
EAPoL frames \(Tx\)\s+[1-9]+[0-9]*
Show output
-------------------------------------------
         Field                  Value
-------------------------------------------
Access Challenges                         0
Authentication Backend               RADIUS
Authentication Failures                   0
Authentication Mode                     N/A
Authentication Status          Unauthorized
Authentication Successes                  0
EAPoL frames (Rx)                         0
EAPoL frames (Tx)                         3
Quiet Period                             60
Reauthenticate                        FALSE
Reauthenticate Period                     0
Session Time                              0
Session User MAC          de:ad:be:ef:6c:12
Session User Name                       N/A

Step 7: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:

IEEE 802.1X: EAP authentication timeout
Show output
Mar 20 09:24:13.296575 osdx hostapd[105281]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported.
Mar 20 09:24:13.296589 osdx hostapd[105281]: eth2: RADIUS Authentication server 10.215.168.1:1812
Mar 20 09:24:13.296790 osdx hostapd[105281]: connect[radius]: Network is unreachable
Mar 20 09:24:13.296629 osdx hostapd[105281]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2
Mar 20 09:24:13.296632 osdx hostapd[105281]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode
Mar 20 09:24:13.324457 osdx hostapd[105281]: Discovery mode enabled on eth2
Mar 20 09:24:13.324529 osdx hostapd[105281]: eth2: interface state UNINITIALIZED->ENABLED
Mar 20 09:24:13.324529 osdx hostapd[105281]: eth2: AP-ENABLED
Mar 20 09:24:18.324644 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 DRIVER: Device discovered, triggering MAB authentication
Mar 20 09:24:18.324690 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added
Mar 20 09:24:18.324699 osdx hostapd[105282]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode
Mar 20 09:24:18.340537 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication
Mar 20 09:24:18.340577 osdx hostapd[105282]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames
Mar 20 09:24:18.340597 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port
Mar 20 09:24:18.340606 osdx hostapd[105282]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication
Mar 20 09:24:18.340643 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 26)
Mar 20 09:24:21.343618 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 26)
Mar 20 09:24:26.063346 osdx OSDxCLI[81197]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Mar 20 09:24:27.347599 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 26)
Mar 20 09:24:34.352296 osdx OSDxCLI[81197]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'.
Mar 20 09:24:39.357601 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: aborting authentication
Mar 20 09:24:39.357613 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying
Mar 20 09:24:39.357630 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DEAUTHENTICATE.indication(de:ad:be:ef:6c:12, 2)
Mar 20 09:24:39.357633 osdx hostapd[105282]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DELETEKEYS.request(de:ad:be:ef:6c:12)