Only 802.1X
This scenario shows how to configure the only-802.1x
authentication mode.
Test Successful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+aKIjcljetmUtnZCUQiT+AD9FtJawAI/BrCco7cojkYQ1aaMB3i7/XTDAY/+KugCcf4mjo7qBO4w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.277 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.277/0.277/0.277/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX18aC9uXKzcO5ONtklca1frMi62AUMJcgMk= set interfaces ethernet eth2 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name testing
Step 7: Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.496 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.496/0.496/0.496/0.000 ms
Step 8: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
Mar 05 18:28:35.230635 osdx hostapd[600526]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. Mar 05 18:28:35.230648 osdx hostapd[600526]: eth2: RADIUS Authentication server 10.215.168.1:1812 Mar 05 18:28:35.230846 osdx hostapd[600526]: connect[radius]: Network is unreachable Mar 05 18:28:35.230685 osdx hostapd[600526]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Mar 05 18:28:35.230689 osdx hostapd[600526]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Mar 05 18:28:35.258539 osdx hostapd[600526]: Discovery mode enabled on eth2 Mar 05 18:28:35.258597 osdx hostapd[600526]: eth2: interface state UNINITIALIZED->ENABLED Mar 05 18:28:35.258597 osdx hostapd[600526]: eth2: AP-ENABLED Mar 05 18:28:38.390727 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added Mar 05 18:28:38.390758 osdx hostapd[600527]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Mar 05 18:28:38.406604 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication Mar 05 18:28:38.406646 osdx hostapd[600527]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Mar 05 18:28:38.406671 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA Mar 05 18:28:38.406682 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port Mar 05 18:28:38.406695 osdx hostapd[600527]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Mar 05 18:28:38.406726 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 68) Mar 05 18:28:38.407116 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=68 len=12) from STA: EAP Response-Identity (1) Mar 05 18:28:38.407131 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'testing' Mar 05 18:28:38.407163 osdx hostapd[600527]: eth2: RADIUS Authentication server 10.215.168.1:1812 Mar 05 18:28:38.409447 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.409475 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.409708 osdx hostapd[600527]: eth2: RADIUS Received 80 bytes from RADIUS server Mar 05 18:28:38.409713 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.409717 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.409735 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=69 len=22) from RADIUS server: EAP-Request-MD5 (4) Mar 05 18:28:38.409741 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 69) Mar 05 18:28:38.409927 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=69 len=6) from STA: EAP Response-unknown (3) Mar 05 18:28:38.409964 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.409975 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.410125 osdx hostapd[600527]: eth2: RADIUS Received 64 bytes from RADIUS server Mar 05 18:28:38.410130 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.410133 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.410144 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=70 len=6) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.410149 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 70) Mar 05 18:28:38.410421 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=70 len=194) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.410450 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.410457 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.411409 osdx hostapd[600527]: eth2: RADIUS Received 1068 bytes from RADIUS server Mar 05 18:28:38.411414 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.411417 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.411433 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=71 len=1004) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.411439 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 71) Mar 05 18:28:38.411555 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=71 len=6) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.411584 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.411593 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.411684 osdx hostapd[600527]: eth2: RADIUS Received 229 bytes from RADIUS server Mar 05 18:28:38.411688 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.411690 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.411701 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=72 len=171) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.411706 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 72) Mar 05 18:28:38.413043 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=72 len=103) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.413077 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.413084 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.413317 osdx hostapd[600527]: eth2: RADIUS Received 115 bytes from RADIUS server Mar 05 18:28:38.413322 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.413325 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.413337 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=73 len=57) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.413342 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 73) Mar 05 18:28:38.413498 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=73 len=6) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.413525 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.413532 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.413648 osdx hostapd[600527]: eth2: RADIUS Received 98 bytes from RADIUS server Mar 05 18:28:38.413653 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.413656 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.413666 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=74 len=40) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.413671 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 74) Mar 05 18:28:38.413786 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=74 len=43) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.413816 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.413824 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.413946 osdx hostapd[600527]: eth2: RADIUS Received 131 bytes from RADIUS server Mar 05 18:28:38.413950 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.413953 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.413963 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=75 len=73) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.413967 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 75) Mar 05 18:28:38.414170 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=75 len=97) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.414195 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.414201 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.414336 osdx hostapd[600527]: eth2: RADIUS Received 140 bytes from RADIUS server Mar 05 18:28:38.414340 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.414342 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.414352 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=76 len=82) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.414356 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 76) Mar 05 18:28:38.414477 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=76 len=37) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.414502 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.414513 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.414616 osdx hostapd[600527]: eth2: RADIUS Received 104 bytes from RADIUS server Mar 05 18:28:38.414620 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.414623 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.414633 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=77 len=46) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:38.414638 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 77) Mar 05 18:28:38.414778 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=77 len=46) from STA: EAP Response-PEAP (25) Mar 05 18:28:38.414802 osdx hostapd[600527]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:38.414811 osdx hostapd[600527]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:38.414936 osdx hostapd[600527]: eth2: RADIUS Received 175 bytes from RADIUS server Mar 05 18:28:38.414941 osdx hostapd[600527]: eth2: RADIUS Received RADIUS message Mar 05 18:28:38.414943 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:38.414961 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' Mar 05 18:28:38.414964 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=3 id=77 len=4) from RADIUS server: EAP Success Mar 05 18:28:38.414976 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 77) Mar 05 18:28:38.414988 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authorizing port Mar 05 18:28:38.414992 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 RADIUS: starting accounting session 621601BE6824A438 Mar 05 18:28:38.414996 osdx hostapd[600527]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/YOLXGTJ3VwyY7TZkD89f964G6eZq2EfuRVlbrh2l168So/a8IcYRtUcA5Zr4WVcVJac5VZ4I+Lg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.593 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.593/0.593/0.593/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1+rt0JPRHpkz1PGdEWea13bKzV2Gd9OdE4= set interfaces ethernet eth2 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 0 EAPoL Frames (Tx) 0 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 0 Req ID Frames (Rx) 0 Resp Frames (Tx) 0 Start Frames (Tx) 0
Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 6: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 7: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 8: Expect a failure in the following command:
Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 9: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
Mar 05 18:28:46.378401 osdx hostapd[601038]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. Mar 05 18:28:46.378417 osdx hostapd[601038]: eth2: RADIUS Authentication server 10.215.168.1:1812 Mar 05 18:28:46.378673 osdx hostapd[601038]: connect[radius]: Network is unreachable Mar 05 18:28:46.378468 osdx hostapd[601038]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Mar 05 18:28:46.378472 osdx hostapd[601038]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Mar 05 18:28:46.398268 osdx hostapd[601038]: Discovery mode enabled on eth2 Mar 05 18:28:46.398361 osdx hostapd[601038]: eth2: interface state UNINITIALIZED->ENABLED Mar 05 18:28:46.398361 osdx hostapd[601038]: eth2: AP-ENABLED Mar 05 18:28:49.930069 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added Mar 05 18:28:49.930081 osdx hostapd[601039]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Mar 05 18:28:49.942295 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication Mar 05 18:28:49.942328 osdx hostapd[601039]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Mar 05 18:28:49.942345 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA Mar 05 18:28:49.942354 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port Mar 05 18:28:49.942363 osdx hostapd[601039]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Mar 05 18:28:49.942391 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 233) Mar 05 18:28:49.942698 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=233 len=10) from STA: EAP Response-Identity (1) Mar 05 18:28:49.942710 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'wrong' Mar 05 18:28:49.942736 osdx hostapd[601039]: eth2: RADIUS Authentication server 10.215.168.1:1812 Mar 05 18:28:49.945171 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.945203 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.945464 osdx hostapd[601039]: eth2: RADIUS Received 80 bytes from RADIUS server Mar 05 18:28:49.945471 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.945476 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.945498 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=234 len=22) from RADIUS server: EAP-Request-MD5 (4) Mar 05 18:28:49.945506 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 234) Mar 05 18:28:49.945720 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=234 len=6) from STA: EAP Response-unknown (3) Mar 05 18:28:49.945766 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.945781 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.945973 osdx hostapd[601039]: eth2: RADIUS Received 64 bytes from RADIUS server Mar 05 18:28:49.945978 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.945981 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.946012 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=235 len=6) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.946018 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 235) Mar 05 18:28:49.946329 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=235 len=194) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.946369 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.946381 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.947664 osdx hostapd[601039]: eth2: RADIUS Received 1068 bytes from RADIUS server Mar 05 18:28:49.947670 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.947674 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.947695 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=236 len=1004) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.947702 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 236) Mar 05 18:28:49.947882 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=236 len=6) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.947922 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.947934 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.948068 osdx hostapd[601039]: eth2: RADIUS Received 229 bytes from RADIUS server Mar 05 18:28:49.948075 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.948079 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.948105 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=237 len=171) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.948112 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 237) Mar 05 18:28:49.949514 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=237 len=103) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.949559 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.949572 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.949890 osdx hostapd[601039]: eth2: RADIUS Received 115 bytes from RADIUS server Mar 05 18:28:49.949896 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.949899 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.949918 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=238 len=57) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.949923 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 238) Mar 05 18:28:49.950215 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=238 len=6) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.950262 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.950277 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.950440 osdx hostapd[601039]: eth2: RADIUS Received 98 bytes from RADIUS server Mar 05 18:28:49.950445 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.950449 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.950468 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=239 len=40) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.950475 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 239) Mar 05 18:28:49.950659 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=239 len=41) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.950693 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.950704 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.950875 osdx hostapd[601039]: eth2: RADIUS Received 131 bytes from RADIUS server Mar 05 18:28:49.950881 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.950884 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.950899 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=240 len=73) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.950905 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 240) Mar 05 18:28:49.951532 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=240 len=95) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.951576 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.951588 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:49.951796 osdx hostapd[601039]: eth2: RADIUS Received 104 bytes from RADIUS server Mar 05 18:28:49.951801 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:49.951804 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:49.951819 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=241 len=46) from RADIUS server: EAP-Request-PEAP (25) Mar 05 18:28:49.951824 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 241) Mar 05 18:28:49.952045 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=241 len=46) from STA: EAP Response-PEAP (25) Mar 05 18:28:49.952098 osdx hostapd[601039]: eth2: RADIUS Sending RADIUS message to authentication server Mar 05 18:28:49.952115 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Mar 05 18:28:50.952235 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Resending RADIUS message (id=8) Mar 05 18:28:50.952276 osdx hostapd[601039]: eth2: RADIUS Next RADIUS client retransmit in 2 seconds Mar 05 18:28:50.952454 osdx hostapd[601039]: eth2: RADIUS Received 44 bytes from RADIUS server Mar 05 18:28:50.952459 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:50.952464 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Mar 05 18:28:50.952521 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=4 id=241 len=4) from RADIUS server: EAP Failure Mar 05 18:28:50.952558 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 241) Mar 05 18:28:50.952574 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port Mar 05 18:28:50.952579 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) Mar 05 18:28:50.952583 osdx hostapd[601039]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) Mar 05 18:28:50.952588 osdx hostapd[601039]: eth2: RADIUS Received 44 bytes from RADIUS server Mar 05 18:28:50.952591 osdx hostapd[601039]: eth2: RADIUS Received RADIUS message Mar 05 18:28:50.952594 osdx hostapd[601039]: eth2: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsupported 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+C5oQKO5AeSpGMW4MKi3yaPPIwVvIiJMtBlRA0aW3RygEJdbDdUbj8egqBfM9vsQEgMm+6iT6JWA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.292 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.292/0.292/0.292/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 5: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 7: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: EAP authentication timeoutShow output
Mar 05 18:29:00.080954 osdx hostapd[601553]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. Mar 05 18:29:00.080982 osdx hostapd[601553]: eth2: RADIUS Authentication server 10.215.168.1:1812 Mar 05 18:29:00.081414 osdx hostapd[601553]: connect[radius]: Network is unreachable Mar 05 18:29:00.081041 osdx hostapd[601553]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 Mar 05 18:29:00.081047 osdx hostapd[601553]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Mar 05 18:29:00.100774 osdx hostapd[601553]: Discovery mode enabled on eth2 Mar 05 18:29:00.100862 osdx hostapd[601553]: eth2: interface state UNINITIALIZED->ENABLED Mar 05 18:29:00.100862 osdx hostapd[601553]: eth2: AP-ENABLED Mar 05 18:29:05.101481 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 DRIVER: Device discovered, triggering MAB authentication Mar 05 18:29:05.101516 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added Mar 05 18:29:05.101524 osdx hostapd[601554]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Mar 05 18:29:05.120802 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication Mar 05 18:29:05.120825 osdx hostapd[601554]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames Mar 05 18:29:05.120838 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port Mar 05 18:29:05.120847 osdx hostapd[601554]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication Mar 05 18:29:05.120882 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 200) Mar 05 18:29:08.123615 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 200) Mar 05 18:29:12.701466 osdx OSDxCLI[559085]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Mar 05 18:29:14.128212 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 200) Mar 05 18:29:20.992121 osdx OSDxCLI[559085]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. Mar 05 18:29:26.137592 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: aborting authentication Mar 05 18:29:26.137605 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying Mar 05 18:29:26.137615 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DEAUTHENTICATE.indication(de:ad:be:ef:6c:12, 2) Mar 05 18:29:26.137618 osdx hostapd[601554]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DELETEKEYS.request(de:ad:be:ef:6c:12)