Only 802.1X
This scenario shows how to configure the only-802.1x
authentication mode.
Test Successful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses the correct username and password.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/g8xLeX2/p3dX51PVbfdAhOQso+RF6Xah8lvTODjK8Vp9HpwjW6h6MX1zSNBSVrwvo+HxFg6+A7A== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.195 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.195/0.195/0.195/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX18KIDq2vg6sJx3WT1AmRrIyMOVnaMgfKMg= set interfaces ethernet eth2 supplicant username testing set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 supplicant show status at DUT1 and check if output contains the following tokens:
AuthorizedShow output
--------------------------------------------------- Field Value --------------------------------------------------- EAP State SUCCESS EAP TLS Cipher ECDHE-RSA-AES256-GCM-SHA384 EAP TLS Version TLSv1.2 PAE State AUTHENTICATED Supplicant Port Status Authorized WPA State COMPLETED
Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+AuthorizedShow output
------------------------------- Field Value ------------------------------- EAPoL Frames (Rx) 11 EAPoL Frames (Tx) 11 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Authorized Req Frames (Rx) 9 Req ID Frames (Rx) 1 Resp Frames (Tx) 10 Start Frames (Tx) 1
Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Successes\s+1 Authentication Mode\s+802\.1XShow output
--------------------------------------------- Field Value --------------------------------------------- Access Challenges 9 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode 802.1X Authentication Status Authorized (802.1X) Authentication Successes 1 EAPoL frames (Rx) 11 EAPoL frames (Tx) 11 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name testing
Step 7: Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. 64 bytes from 192.168.100.1: icmp_seq=1 ttl=64 time=0.380 ms --- 192.168.100.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.380/0.380/0.380/0.000 ms
Step 8: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: authenticated - EAP type: 25 (PEAP)Show output
May 04 18:15:07.421129 osdx hostapd[60242]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. May 04 18:15:07.421148 osdx hostapd[60242]: eth2: RADIUS Authentication server 10.215.168.1:1812 May 04 18:15:07.421455 osdx hostapd[60242]: connect[radius]: Network is unreachable May 04 18:15:07.421197 osdx hostapd[60242]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 May 04 18:15:07.421201 osdx hostapd[60242]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode May 04 18:15:07.440888 osdx hostapd[60242]: Discovery mode enabled on eth2 May 04 18:15:07.440982 osdx hostapd[60242]: eth2: interface state UNINITIALIZED->ENABLED May 04 18:15:07.440982 osdx hostapd[60242]: eth2: AP-ENABLED May 04 18:15:10.922217 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added May 04 18:15:10.922234 osdx hostapd[60243]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode May 04 18:15:10.936912 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication May 04 18:15:10.936939 osdx hostapd[60243]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames May 04 18:15:10.936954 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA May 04 18:15:10.936968 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port May 04 18:15:10.936977 osdx hostapd[60243]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication May 04 18:15:10.936999 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 109) May 04 18:15:10.937355 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=109 len=12) from STA: EAP Response-Identity (1) May 04 18:15:10.937366 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'testing' May 04 18:15:10.937391 osdx hostapd[60243]: eth2: RADIUS Authentication server 10.215.168.1:1812 May 04 18:15:10.939210 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.939239 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.939465 osdx hostapd[60243]: eth2: RADIUS Received 80 bytes from RADIUS server May 04 18:15:10.939470 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.939473 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.939493 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=110 len=22) from RADIUS server: EAP-Request-MD5 (4) May 04 18:15:10.939500 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 110) May 04 18:15:10.939710 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=110 len=6) from STA: EAP Response-unknown (3) May 04 18:15:10.939756 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.939772 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.939946 osdx hostapd[60243]: eth2: RADIUS Received 64 bytes from RADIUS server May 04 18:15:10.939951 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.939954 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.939970 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=111 len=6) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.939975 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 111) May 04 18:15:10.940277 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=111 len=194) from STA: EAP Response-PEAP (25) May 04 18:15:10.940335 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.940350 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.941309 osdx hostapd[60243]: eth2: RADIUS Received 1068 bytes from RADIUS server May 04 18:15:10.941316 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.941320 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.941343 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=112 len=1004) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.941350 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 112) May 04 18:15:10.941511 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=112 len=6) from STA: EAP Response-PEAP (25) May 04 18:15:10.941556 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.941574 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.941669 osdx hostapd[60243]: eth2: RADIUS Received 229 bytes from RADIUS server May 04 18:15:10.941675 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.941679 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.941694 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=113 len=171) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.941701 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 113) May 04 18:15:10.943046 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=113 len=103) from STA: EAP Response-PEAP (25) May 04 18:15:10.943093 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.943106 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.943418 osdx hostapd[60243]: eth2: RADIUS Received 115 bytes from RADIUS server May 04 18:15:10.943425 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.943429 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.943449 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=114 len=57) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.943456 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 114) May 04 18:15:10.943688 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=114 len=6) from STA: EAP Response-PEAP (25) May 04 18:15:10.943727 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.943740 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.943883 osdx hostapd[60243]: eth2: RADIUS Received 98 bytes from RADIUS server May 04 18:15:10.943888 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.943891 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.943904 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=115 len=40) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.943909 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 115) May 04 18:15:10.944060 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=115 len=43) from STA: EAP Response-PEAP (25) May 04 18:15:10.944092 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.944102 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.944265 osdx hostapd[60243]: eth2: RADIUS Received 131 bytes from RADIUS server May 04 18:15:10.944270 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.944273 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.944285 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=116 len=73) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.944290 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 116) May 04 18:15:10.944612 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=116 len=97) from STA: EAP Response-PEAP (25) May 04 18:15:10.944662 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.944676 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.944884 osdx hostapd[60243]: eth2: RADIUS Received 140 bytes from RADIUS server May 04 18:15:10.944890 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.944893 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.944910 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=117 len=82) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.944916 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 117) May 04 18:15:10.945113 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=117 len=37) from STA: EAP Response-PEAP (25) May 04 18:15:10.945157 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.945170 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.945340 osdx hostapd[60243]: eth2: RADIUS Received 104 bytes from RADIUS server May 04 18:15:10.945346 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.945350 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.945370 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=118 len=46) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:10.945377 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 118) May 04 18:15:10.945616 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=118 len=46) from STA: EAP Response-PEAP (25) May 04 18:15:10.945660 osdx hostapd[60243]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:10.945675 osdx hostapd[60243]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:10.945894 osdx hostapd[60243]: eth2: RADIUS Received 175 bytes from RADIUS server May 04 18:15:10.945901 osdx hostapd[60243]: eth2: RADIUS Received RADIUS message May 04 18:15:10.945905 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:10.945929 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: old identity 'testing' updated with User-Name from Access-Accept 'testing' May 04 18:15:10.945934 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=3 id=118 len=4) from RADIUS server: EAP Success May 04 18:15:10.945951 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 118) May 04 18:15:10.945968 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authorizing port May 04 18:15:10.945972 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 RADIUS: starting accounting session 60285564500AE427 May 04 18:15:10.945976 osdx hostapd[60243]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authenticated - EAP type: 25 (PEAP)
Test Unsuccessful 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 uses an incorrect username.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX18pALw/wcORwfejWqzOXkii2osnJz2XhzHrH0puy6/pyamhL8PBquQyW95+BGhuMw9HHJBeKSyF6w== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.267 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.267/0.267/0.267/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set interfaces ethernet eth2 supplicant encrypted-password U2FsdGVkX1/v87w6W8jv1GRKdHK+SDsCG/W5rXXzO+g= set interfaces ethernet eth2 supplicant username wrong set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 0 EAPoL Frames (Tx) 0 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 0 Req ID Frames (Rx) 0 Resp Frames (Tx) 0 Start Frames (Tx) 0
Step 5: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 9 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 6: Run command interfaces ethernet eth2 supplicant show stats at DUT1 and check if output matches the following regular expressions:
Port Status\s+UnauthorizedShow output
--------------------------------- Field Value --------------------------------- EAPoL Frames (Rx) 10 EAPoL Frames (Tx) 10 Invalid Frames (Rx) 0 Logoff Frames (Tx) 0 Port Status Unauthorized Req Frames (Rx) 8 Req ID Frames (Rx) 1 Resp Frames (Tx) 9 Start Frames (Tx) 1
Step 7: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
Authentication Failures\s+[1-9]\d?Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 8 Authentication Backend RADIUS Authentication Failures 1 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 10 EAPoL frames (Tx) 10 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 8: Expect a failure in the following command:
Ping IP address 192.168.100.1 from DUT1:
admin@DUT1$ ping 192.168.100.1 count 1 size 56 timeout 1Show output
PING 192.168.100.1 (192.168.100.1) 56(84) bytes of data. --- 192.168.100.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
Step 9: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: authentication failed - EAP type: 25 (PEAP)Show output
May 04 18:15:18.268919 osdx hostapd[60762]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. May 04 18:15:18.268932 osdx hostapd[60762]: eth2: RADIUS Authentication server 10.215.168.1:1812 May 04 18:15:18.269197 osdx hostapd[60762]: connect[radius]: Network is unreachable May 04 18:15:18.268975 osdx hostapd[60762]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 May 04 18:15:18.268978 osdx hostapd[60762]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode May 04 18:15:18.284828 osdx hostapd[60762]: Discovery mode enabled on eth2 May 04 18:15:18.284902 osdx hostapd[60762]: eth2: interface state UNINITIALIZED->ENABLED May 04 18:15:18.284902 osdx hostapd[60762]: eth2: AP-ENABLED May 04 18:15:21.607162 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added May 04 18:15:21.607175 osdx hostapd[60763]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode May 04 18:15:21.620833 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication May 04 18:15:21.620866 osdx hostapd[60763]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames May 04 18:15:21.620882 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAPOL-Start from STA May 04 18:15:21.620890 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port May 04 18:15:21.620898 osdx hostapd[60763]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication May 04 18:15:21.620921 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 39) May 04 18:15:21.621257 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=39 len=10) from STA: EAP Response-Identity (1) May 04 18:15:21.621268 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: STA identity 'wrong' May 04 18:15:21.621297 osdx hostapd[60763]: eth2: RADIUS Authentication server 10.215.168.1:1812 May 04 18:15:21.623046 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.623076 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.623285 osdx hostapd[60763]: eth2: RADIUS Received 80 bytes from RADIUS server May 04 18:15:21.623290 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.623294 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.623314 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=40 len=22) from RADIUS server: EAP-Request-MD5 (4) May 04 18:15:21.623322 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 40) May 04 18:15:21.623515 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=40 len=6) from STA: EAP Response-unknown (3) May 04 18:15:21.623557 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.623570 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.623706 osdx hostapd[60763]: eth2: RADIUS Received 64 bytes from RADIUS server May 04 18:15:21.623711 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.623715 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.623730 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=41 len=6) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.623736 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 41) May 04 18:15:21.624013 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=41 len=194) from STA: EAP Response-PEAP (25) May 04 18:15:21.624055 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.624067 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.625045 osdx hostapd[60763]: eth2: RADIUS Received 1068 bytes from RADIUS server May 04 18:15:21.625051 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.625055 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.625076 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=42 len=1004) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.625083 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 42) May 04 18:15:21.625211 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=42 len=6) from STA: EAP Response-PEAP (25) May 04 18:15:21.625248 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.625259 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.625360 osdx hostapd[60763]: eth2: RADIUS Received 229 bytes from RADIUS server May 04 18:15:21.625366 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.625369 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.625383 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=43 len=171) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.625389 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 43) May 04 18:15:21.626613 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=43 len=103) from STA: EAP Response-PEAP (25) May 04 18:15:21.626648 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.626659 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.626907 osdx hostapd[60763]: eth2: RADIUS Received 115 bytes from RADIUS server May 04 18:15:21.626913 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.626916 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.626932 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=44 len=57) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.626937 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 44) May 04 18:15:21.627130 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=44 len=6) from STA: EAP Response-PEAP (25) May 04 18:15:21.627166 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.627176 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.627283 osdx hostapd[60763]: eth2: RADIUS Received 98 bytes from RADIUS server May 04 18:15:21.627288 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.627292 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.627308 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=45 len=40) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.627314 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 45) May 04 18:15:21.627432 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=45 len=41) from STA: EAP Response-PEAP (25) May 04 18:15:21.627463 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.627474 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.627609 osdx hostapd[60763]: eth2: RADIUS Received 131 bytes from RADIUS server May 04 18:15:21.627614 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.627618 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.627632 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=46 len=73) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.627637 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 46) May 04 18:15:21.627839 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=46 len=95) from STA: EAP Response-PEAP (25) May 04 18:15:21.627872 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.627881 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:21.628011 osdx hostapd[60763]: eth2: RADIUS Received 104 bytes from RADIUS server May 04 18:15:21.628016 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:21.628019 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:21.628032 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=1 id=47 len=46) from RADIUS server: EAP-Request-PEAP (25) May 04 18:15:21.628038 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 47) May 04 18:15:21.628219 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: received EAP packet (code=2 id=47 len=46) from STA: EAP Response-PEAP (25) May 04 18:15:21.628253 osdx hostapd[60763]: eth2: RADIUS Sending RADIUS message to authentication server May 04 18:15:21.628264 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 1 seconds May 04 18:15:22.628364 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Resending RADIUS message (id=8) May 04 18:15:22.628410 osdx hostapd[60763]: eth2: RADIUS Next RADIUS client retransmit in 2 seconds May 04 18:15:22.628603 osdx hostapd[60763]: eth2: RADIUS Received 44 bytes from RADIUS server May 04 18:15:22.628608 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:22.628613 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.00 sec May 04 18:15:22.628666 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: decapsulated EAP packet (code=4 id=47 len=4) from RADIUS server: EAP Failure May 04 18:15:22.628791 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 47) May 04 18:15:22.628809 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port May 04 18:15:22.628813 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: authentication failed - EAP type: 25 (PEAP) May 04 18:15:22.628816 osdx hostapd[60763]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Authentication failed, enforcing quiet period (60 seconds) May 04 18:15:22.628821 osdx hostapd[60763]: eth2: RADIUS Received 44 bytes from RADIUS server May 04 18:15:22.628825 osdx hostapd[60763]: eth2: RADIUS Received RADIUS message May 04 18:15:22.628828 osdx hostapd[60763]: eth2: RADIUS No matching RADIUS request found (type=0 id=8) - dropping packet
Test Unsupported 802.1x Authentication
Description
This scenario shows how to configure 802.1x-only authentication. DUT1 does not support 802.1x authentication.
Scenario
Step 1: Set the following configuration in DUT0 :
set interfaces ethernet eth0 address 10.215.168.64/24 set interfaces ethernet eth2 address 192.168.100.1/24 set interfaces ethernet eth2 authenticator 802.1x max-retransmissions 2 set interfaces ethernet eth2 authenticator aaa authentication list1 set interfaces ethernet eth2 authenticator log-level debug set interfaces ethernet eth2 authenticator mode only-802.1x set interfaces ethernet eth2 authenticator quiet-period 60 set interfaces ethernet eth2 authenticator reauth-period 0 set system aaa group radius radgroup1 server serv1 set system aaa list list1 method 1 group radius radgroup1 set system aaa server radius serv1 address 10.215.168.1 set system aaa server radius serv1 encrypted-key U2FsdGVkX1/NbVcxSA3yj1FhS2GeF+1N301czw+q6UB2MhnA4ZnrkIrKWMfMegQ3Of1ICeAnB9BtDkW8NRNjkQ== set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 2: Ping IP address 10.215.168.1 from DUT0:
admin@DUT0$ ping 10.215.168.1 count 1 size 56 timeout 1Show output
PING 10.215.168.1 (10.215.168.1) 56(84) bytes of data. 64 bytes from 10.215.168.1: icmp_seq=1 ttl=64 time=0.404 ms --- 10.215.168.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.404/0.404/0.404/0.000 ms
Step 3: Set the following configuration in DUT1 :
set interfaces ethernet eth2 address 192.168.100.2/24 set system login user admin authentication encrypted-password '$6$GSjsCj8gHLv$/VcqU6FLi6CT2Oxn0MJQ2C2tqnRDrYKNF8HIYWJp68nvXvPdFccDsT04.WtigUONbKYrgKg8d6rEs8PjljMkH0'
Step 4: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 2 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 5: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 6: Run command interfaces ethernet eth2 authenticator show stats at DUT0 and check if output matches the following regular expressions:
EAPoL frames \(Rx\)\s+0 EAPoL frames \(Tx\)\s+[1-9]+[0-9]*Show output
------------------------------------------- Field Value ------------------------------------------- Access Challenges 0 Authentication Backend RADIUS Authentication Failures 0 Authentication Mode N/A Authentication Status Unauthorized Authentication Successes 0 EAPoL frames (Rx) 0 EAPoL frames (Tx) 3 Quiet Period 60 Reauthenticate FALSE Reauthenticate Period 0 Session Time 0 Session User MAC de:ad:be:ef:6c:12 Session User Name N/A
Step 7: Run command system journal show | grep "osdx hostapd" at DUT0 and check if output contains the following tokens:
IEEE 802.1X: EAP authentication timeoutShow output
May 04 18:15:32.305537 osdx hostapd[61280]: eth2: IEEE 802.11 Fetching hardware channel/rate support not supported. May 04 18:15:32.305761 osdx hostapd[61280]: connect[radius]: Network is unreachable May 04 18:15:32.305552 osdx hostapd[61280]: eth2: RADIUS Authentication server 10.215.168.1:1812 May 04 18:15:32.305587 osdx hostapd[61280]: eth2: IEEE 802.1X Initializing IEEE 802.1X: mode=802.1X, eap_server=0, eap_quiet_period=60, eap_max_retrans=2 May 04 18:15:32.305590 osdx hostapd[61280]: eth2: IEEE 802.1X IEEE 802.1X: Enabling packet capture discovery mode May 04 18:15:32.329423 osdx hostapd[61280]: Discovery mode enabled on eth2 May 04 18:15:32.329480 osdx hostapd[61280]: eth2: interface state UNINITIALIZED->ENABLED May 04 18:15:32.329480 osdx hostapd[61280]: eth2: AP-ENABLED May 04 18:15:37.329769 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 DRIVER: Device discovered, triggering MAB authentication May 04 18:15:37.329808 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: New STA de:ad:be:ef:6c:12 added May 04 18:15:37.329817 osdx hostapd[61281]: eth2: IEEE 802.1X IEEE 802.1X: Disabling packet capture discovery mode May 04 18:15:37.353482 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: start authentication May 04 18:15:37.353517 osdx hostapd[61281]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: disabling transmission of periodic EAP-Request frames May 04 18:15:37.353536 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: unauthorizing port May 04 18:15:37.353547 osdx hostapd[61281]: eth2: STA 01:80:c2:00:00:03 IEEE 802.1X: Trying RADIUS authentication May 04 18:15:37.353586 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 129) May 04 18:15:40.355779 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 129) May 04 18:15:44.916559 osdx OSDxCLI[4873]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. May 04 18:15:46.359767 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: Sending EAP Packet (identifier 129) May 04 18:15:53.185015 osdx OSDxCLI[4873]: User 'admin' executed a new command: 'system journal show | grep "osdx hostapd"'. May 04 18:15:58.369796 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: aborting authentication May 04 18:15:58.369810 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 IEEE 802.1X: EAP authentication timeout - enforcing 60 second quiet period before retrying May 04 18:15:58.369824 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DEAUTHENTICATE.indication(de:ad:be:ef:6c:12, 2) May 04 18:15:58.369828 osdx hostapd[61281]: eth2: STA de:ad:be:ef:6c:12 MLME: MLME-DELETEKEYS.request(de:ad:be:ef:6c:12)