Only Mab
This scenario shows how to configure the only-MAB
authentication mode.
Test Successful MAB Authentication
Description
This scenario shows how to configure MAB-only authentication. DUT1 uses a correct MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-MAB set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1+gqhEvUbSJTT+YNMXaZ2enuQ3VsMwdLYuVXpIQllXm7QUhDKuqG0cio+aJzbAIJjvndRk8oizLrA== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.391 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.391/0.391/0.391/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.920 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.920/0.920/0.920/0.000 ms
Step 5: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+MABShow output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode MAB Authentication Status Authorized (MAB) Authentication Successes 1 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 6: Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.628 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.628/0.628/0.628/0.000 ms
Step 7: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
802.1X: MAB: station successfully authenticatedShow output
Apr 16 23:27:59.191334 osdx hostapd[1063253]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. Apr 16 23:27:59.191645 osdx hostapd[1063253]: connect[radius]: Network is unreachable Apr 16 23:27:59.191349 osdx hostapd[1063253]: eth2: RADIUS Authentication server 10.215.168.1:1812 Apr 16 23:27:59.191397 osdx hostapd[1063253]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-only, eap_server=0, eap_quiet_period=60, eap_max_retrans=5 Apr 16 23:27:59.191401 osdx hostapd[1063253]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Apr 16 23:27:59.219156 osdx hostapd[1063253]: Discovery mode enabled on eth2 Apr 16 23:27:59.219254 osdx hostapd[1063253]: eth2: interface state UNINITIALIZED->ENABLED Apr 16 23:27:59.219254 osdx hostapd[1063253]: eth2: AP-ENABLED Apr 16 23:28:04.219488 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 DRIVER: Device discovered, triggering MAB authentication Apr 16 23:28:04.219530 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added Apr 16 23:28:04.219539 osdx hostapd[1063254]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Apr 16 23:28:04.235161 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB-only mode: Starting MAB authentication Apr 16 23:28:04.235201 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: Starting RADIUS query Apr 16 23:28:04.235219 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: User-Name = de:ad:be:ef:6c:12 Apr 16 23:28:04.237309 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: User-Password = de:ad:be:ef:6c:12 Apr 16 23:28:04.237322 osdx hostapd[1063254]: eth2: RADIUS Authentication server 10.215.168.1:1812 Apr 16 23:28:04.237418 osdx hostapd[1063254]: eth2: RADIUS Sending RADIUS message to authentication server Apr 16 23:28:04.237448 osdx hostapd[1063254]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Apr 16 23:28:04.237729 osdx hostapd[1063254]: eth2: RADIUS Received 20 bytes from RADIUS server Apr 16 23:28:04.237735 osdx hostapd[1063254]: eth2: RADIUS Received RADIUS message Apr 16 23:28:04.237740 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Apr 16 23:28:04.237744 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: Processing RADIUS response Apr 16 23:28:04.237760 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: Identity set to 'de:ad:be:ef:6c:12' Apr 16 23:28:04.237778 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: MAB: station successfully authenticated Apr 16 23:28:04.237782 osdx hostapd[1063254]: eth2: IEEE 802.1X IEEE 802.1X: Discovery already disabled Apr 16 23:28:04.237796 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authorizing port Apr 16 23:28:04.237800 osdx hostapd[1063254]: eth2: STA de:ad:be:ef:6c:12 RADIUS: starting accounting session 475B9443169AF68D
Test Unsuccessful MAB Authentication
Description
This scenario shows how to configure MAB-only authentication. DUT1 uses an incorrect MAC address.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-MAB set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/3/qWj1k80LDu7aF3cJUXrE22qCtP/TdZ1YUykMb2nEh2j9KzfSMaXRRem5s5N2s2oFNy3P2GMjg== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.590 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.590/0.590/0.590/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set interfaces ethernet eth2 mac '00:11:22:33:44:55' set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 2 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 0 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC 00:11:22:33:44:55 Session User Name N/A
Step 5: Expect a failure in the following command:
Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 6: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
802.1X: MAB: Authentication failedShow output
Apr 16 23:28:15.661894 osdx hostapd[1063780]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. Apr 16 23:28:15.661908 osdx hostapd[1063780]: eth2: RADIUS Authentication server 10.215.168.1:1812 Apr 16 23:28:15.662221 osdx hostapd[1063780]: connect[radius]: Network is unreachable Apr 16 23:28:15.661952 osdx hostapd[1063780]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=MAB-only, eap_server=0, eap_quiet_period=60, eap_max_retrans=5 Apr 16 23:28:15.661955 osdx hostapd[1063780]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode Apr 16 23:28:15.685741 osdx hostapd[1063780]: Discovery mode enabled on eth2 Apr 16 23:28:15.685835 osdx hostapd[1063780]: eth2: interface state UNINITIALIZED->ENABLED Apr 16 23:28:15.685835 osdx hostapd[1063780]: eth2: AP-ENABLED Apr 16 23:28:20.686086 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 DRIVER: Device discovered, triggering MAB authentication Apr 16 23:28:20.686140 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: New STA 00:11:22:33:44:55 added Apr 16 23:28:20.686149 osdx hostapd[1063781]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode Apr 16 23:28:20.701826 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB-only mode: Starting MAB authentication Apr 16 23:28:20.701872 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Starting RADIUS query Apr 16 23:28:20.701892 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Name = 00:11:22:33:44:55 Apr 16 23:28:20.703681 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: User-Password = 00:11:22:33:44:55 Apr 16 23:28:20.703694 osdx hostapd[1063781]: eth2: RADIUS Authentication server 10.215.168.1:1812 Apr 16 23:28:20.703781 osdx hostapd[1063781]: eth2: RADIUS Sending RADIUS message to authentication server Apr 16 23:28:20.703819 osdx hostapd[1063781]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds Apr 16 23:28:21.703933 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 RADIUS: Resending RADIUS message (id=128) Apr 16 23:28:21.704080 osdx hostapd[1063781]: eth2: RADIUS Next RADIUS client retransmit in 2 seconds Apr 16 23:28:21.704418 osdx hostapd[1063781]: eth2: RADIUS Received 20 bytes from RADIUS server Apr 16 23:28:21.704426 osdx hostapd[1063781]: eth2: RADIUS Received RADIUS message Apr 16 23:28:21.704431 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec Apr 16 23:28:21.704436 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Processing RADIUS response Apr 16 23:28:21.704489 osdx hostapd[1063781]: eth2: IEEE 802.1X IEEE 802.1X: Discovery already disabled Apr 16 23:28:21.704492 osdx hostapd[1063781]: eth2: IEEE 802.1X IEEE 802.1X: Discovery already disabled Apr 16 23:28:21.704496 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Authentication failed, entering held state (quiet period 60 sec) Apr 16 23:28:21.704499 osdx hostapd[1063781]: eth2: STA 00:11:22:33:44:55 IEEE 802.1X: MAB: Retry timeout registered for 60 seconds Apr 16 23:28:21.704508 osdx hostapd[1063781]: eth2: RADIUS Received 20 bytes from RADIUS server Apr 16 23:28:21.704511 osdx hostapd[1063781]: eth2: RADIUS Received RADIUS message Apr 16 23:28:21.704514 osdx hostapd[1063781]: eth2: RADIUS No matching RADIUS request found (type=0 id=128) - dropping packet