Fortinet Document Library

Version:


Table of Contents

Cookbook

6.1.0
Download PDF
Copy Link

Results

  1. Connect the wired device (in this case, the printer).
  2. Using tcpdump, FortiAuthenticator shows receipt of an incoming authentication request (execute tcpdump host 10.1.2.27 -nnvvXS):

    tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes

    17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)

    10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157

    Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a

    User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint

    0x0000: 3030 3232 3638 3161 6631 6130

    NAS-Port Attribute (5), length: 6, Value: 70

    0x0000: 0000 0046

    EAP-Message Attribute (79), length: 19, Value: .

    0x0000: 0200 0011 0130 3032 3236 3831 6166 3161

    0x0010: 30

    Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x

    0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778

    Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442

    0x0000: 384f 322e 3178 3831 6661 3030 3235 3030

    0x0010: 3037 3834 3432

    NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0

    0x0000: 6765 2430 2f30 2f30 2e30

    Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0

    0x0000: 3030 2032 3220 3638 2031 6120 6631 2461

    0x0010: 30

    Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80

    0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38

    0x0010: 30

    NAS-Port-Type Attribute (61), length: 6, value: Ethernet

    0x0000: 0000 000f

  3. On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.
  4. The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

  5. Continuing with the tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

    17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73)

    10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45

    Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2

    Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13

    0x0000: 0000 000d

    Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802

    0x0000: 0000 0006

    Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering

    0x0000: 656e 6769 6e65 6572 696e 67

    0x0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......

    0x0010: 0a01 021b 0714 ead2 0035 1880 0208 002d 5

    0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X..

    0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en

    0x0040: 6769 6e65 6572 696e 67 gineering

  6. Post-authentication DHCP transaction is picked up by FortiAuthenticator

    The Switch CLI shows a successful dot1x session:

    root# run show dotlx interface ge-0/0/0.0

    802.1X Information:

    Interface Role State MAC address User

    ge-0/0/0.0 Authenticator Authenticated 00:22:68:1A:F1:A0 0022681af1a0

    The MAC address interface has been dynamically placed into correct VLAN:

    root# run show vlans engineering

    Name Tag Interfaces

    engineering 10

    ge-0/0/0.0*, ge-0/0/11.0*

    Additionally, the printer shows as available on the network:

    root# run show arp interface vlan.10

    MAC Address Address Name Interface Flags

    00:0c:29:5b:90:68 10.1.2.29 10.1.2.29 vlan.10 none

    6c:70:9f:d6:ae:al 10.1.2.220 10.1.2.220 vlan.10 none

    b8:53:ac:4a:d5:f5 10.1.2.221 10.1.2.221 vlan.10 none

    00:22:68:1a:fl:a0 10.1.2.224 10.1.2.224 vlan.10 none

    a4:c3:61:24:b9:07 10.1.2.228 10.1.2.228 vlan.10 none

    Total entries: 5

     

    {master:0}[edit]

    root* run ping 10.1.2.224

    PING 10.1.2.224 (10.1.2.224): 56 data bytes

    64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms

    64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms

    64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms

     

    --- 10.1.2.224 ping statistics ---

    3 packets transmitted, 3 packets received, 0% packet loss

    round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms

Results

  1. Connect the wired device (in this case, the printer).
  2. Using tcpdump, FortiAuthenticator shows receipt of an incoming authentication request (execute tcpdump host 10.1.2.27 -nnvvXS):

    tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes

    17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)

    10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157

    Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a

    User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint

    0x0000: 3030 3232 3638 3161 6631 6130

    NAS-Port Attribute (5), length: 6, Value: 70

    0x0000: 0000 0046

    EAP-Message Attribute (79), length: 19, Value: .

    0x0000: 0200 0011 0130 3032 3236 3831 6166 3161

    0x0010: 30

    Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x

    0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778

    Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442

    0x0000: 384f 322e 3178 3831 6661 3030 3235 3030

    0x0010: 3037 3834 3432

    NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0

    0x0000: 6765 2430 2f30 2f30 2e30

    Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0

    0x0000: 3030 2032 3220 3638 2031 6120 6631 2461

    0x0010: 30

    Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80

    0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38

    0x0010: 30

    NAS-Port-Type Attribute (61), length: 6, value: Ethernet

    0x0000: 0000 000f

  3. On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.
  4. The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

  5. Continuing with the tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

    17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73)

    10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45

    Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2

    Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13

    0x0000: 0000 000d

    Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802

    0x0000: 0000 0006

    Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering

    0x0000: 656e 6769 6e65 6572 696e 67

    0x0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......

    0x0010: 0a01 021b 0714 ead2 0035 1880 0208 002d 5

    0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X..

    0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en

    0x0040: 6769 6e65 6572 696e 67 gineering

  6. Post-authentication DHCP transaction is picked up by FortiAuthenticator

    The Switch CLI shows a successful dot1x session:

    root# run show dotlx interface ge-0/0/0.0

    802.1X Information:

    Interface Role State MAC address User

    ge-0/0/0.0 Authenticator Authenticated 00:22:68:1A:F1:A0 0022681af1a0

    The MAC address interface has been dynamically placed into correct VLAN:

    root# run show vlans engineering

    Name Tag Interfaces

    engineering 10

    ge-0/0/0.0*, ge-0/0/11.0*

    Additionally, the printer shows as available on the network:

    root# run show arp interface vlan.10

    MAC Address Address Name Interface Flags

    00:0c:29:5b:90:68 10.1.2.29 10.1.2.29 vlan.10 none

    6c:70:9f:d6:ae:al 10.1.2.220 10.1.2.220 vlan.10 none

    b8:53:ac:4a:d5:f5 10.1.2.221 10.1.2.221 vlan.10 none

    00:22:68:1a:fl:a0 10.1.2.224 10.1.2.224 vlan.10 none

    a4:c3:61:24:b9:07 10.1.2.228 10.1.2.228 vlan.10 none

    Total entries: 5

     

    {master:0}[edit]

    root* run ping 10.1.2.224

    PING 10.1.2.224 (10.1.2.224): 56 data bytes

    64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms

    64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms

    64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms

     

    --- 10.1.2.224 ping statistics ---

    3 packets transmitted, 3 packets received, 0% packet loss

    round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms