Apresia X24-PSRRADIUSfullflex EG fullflex EG VLAN Login Web MAC Web/MAC 802.1X EAP-TLS, PEAP

Transcription

1 Apresia GX-PSR Contents: Apresia GX-PSR MANAGE RADIUS VLAN fullflex EG fullflex RADIUS Web MAC Web/MAC IEEE 802.1x EAP-TLS PEAP

2 Apresia X24-PSRRADIUSfullflex EG fullflex EG VLAN Login Web MAC Web/MAC 802.1X EAP-TLS, PEAP

3 Apresia GX-PSR AEOS: Ver MANAGE MANAGE telnet IP: > enable # configure terminal (config)# interface manage (config-if-mng)# ip address /24 (config-if-mng)# exit (config)# exit # write memory RADIUS RADIUS IEEE802.1X Web MAC Web/MAC RADIUS RADIUS host: port: VLAN VLAN v10 - VLAN v20 - VLAN server(192) - RADIUSDHCP temp(4094) - VLAN interface ports

4 21-23 : (temp) 24 : RADIUS(server) UTP : (config)# interface port (config-if-port)# media utp (config-if-port)# exit DHCP : (config)# packet-filter2 (config-filter)# 2 assign port (config-filter)# 2 1 condition ipv4 dst tcp/udp 67 udp (config-filter)# 2 1 action authentication-bypass (config-filter)# exit VLAN : (config)# vlan database (config-vlan)# vlan 10 name v10 (config-vlan)# vlan 20 name v20 (config-vlan)# vlan 100 name mgmt (config-vlan)# vlan 192 name server (config-vlan)# vlan 4094 name temp (config-vlan)# exit VLAN access: (config)# interface port (config-if-port)# switchport access vlan 4094 (config-if-port)# exit 24 port serverradius : (config)# interface port 24 (config-if-port)# switchport access vlan 192 (config-if-port)# exit VLAN(mgmt) VLAN(temp)VLAN(server) : (config)# interface vlan 4094 (config-if)# ip address /16 (config-if)# exit (config)# interface vlan 100 (config-if)# ip address /24 (config-if)# exit (config)# interface vlan 192 (config-if)# ip address /24 (config-if)# exit VLAN

5 (config)# interface vlan 10 (config-if)# ip address /24 (config-if)# exit (config)# interface vlan 20 (config-if)# ip address /24 (config-if)# exit : (config)# ip route / DHCP: (config)# dhcp policy temp (config-dhcp)# network /16 (config-dhcp)# range (config-dhcp)# router (config-dhcp)# lease 10 (config-dhcp)# exit (config)# dhcp policy enable temp (config)# dhcp policy v10 (config-dhcp)# network /24 (config-dhcp)# range (config-dhcp)# router (config-dhcp)# exit (config)# dhcp policy enable v10 (config)# dhcp policy v20 (config-dhcp)# network /24 (config-dhcp)# range (config-dhcp)# router (config-dhcp)# exit (config)# dhcp policy enable v20 (config)# dhcp server address-check arp (config)# dhcp server enable (config)# exit # write memory show running-config # show running-config username adpro adpro username user user packet-filter2 2 assign port condition ipv4 dst tcp/udp 67 udp 2 1 action authentication-bypass no ip multicast-routing

6 vlan database vlan 10 name v10 vlan 20 name v20 vlan 100 name mgmt vlan 192 name server vlan 4094 name temp interface loopback interface manage ip address /24 interface port 1 interface port 2 interface port 3 interface port 4 interface port 5 interface port 6 interface port 7 interface port 8 interface port 9 interface port 10 interface port 11 interface port 12 interface port 13 interface port 14 interface port 15 interface port 16 interface port 17 interface port 18 interface port 19 interface port 20 interface port 21 media utp switchport access vlan 4094 interface port 22 media utp switchport access vlan 4094 interface port 23 media utp switchport access vlan 4094 interface port 24

7 media utp switchport access vlan 192 interface port 25 interface port 26 interface port 27 interface port 28 interface vlan 1 interface vlan 10 ip address /24 interface vlan 20 ip address /24 interface vlan 100 ip address /24 interface vlan 192 ip address /24 interface vlan 4094 ip address /16 ip route / dhcp policy temp network /16 range router lease 10 dhcp policy v10 network /24 range router dhcp policy v20 network /24 range router dhcp policy enable temp dhcp policy enable v10 dhcp policy enable v20 dhcp server address-check arp dhcp server enable end # show vlan: # show vlan --- vlan port information --- a = access-port t = trunk-port Port

8 Port Mode aaaaaaaa aaaaaaaa aaaaaaaa aaaa --- vlan mapping information --- St = Status En = Enable Dis = Disable u = untag t = tag p = protocol vlan d = dynamic port vlan Port Name VID St default 1 En uuuuuuuu uuuuuuuu uuuu... uuuu v10 10 En v20 20 En mgmt 100 En server 192 En u... temp 4094 En uuu protocol vlan information --- VID protocol type SNAP nonzero OUI: Disable #

9 fullflex EG fullflex : fullflex EG7 : : 191 RADIUS VSAfullflex dictionary.hcl dictionary dictionary.hcl: # fullflex RADIUS # Copyright (c) Accense, Technology, Inc. # All rights reserved. # # Vendor Specific Attributes # VENDOR Hitachi-Cable 278 ATTRIBUTE Hitachi-Cable:NA-Vlan-Id 192 integer dictionary: # Vendor Specific Attributes # 4 VENDOR ACC 5 VENDOR Cisco 9 VENDOR Xylogics 15 VENDOR Wellfleet 18 VENDOR Digital-Equipment 36 VENDOR 3Com 43 VENDOR Merit 61 VENDOR Shiva 166 VENDOR Hitachi-Cable 278 dictionary.hcl VENDOR Livingston 307 VENDOR Microsoft 311 VENDOR U.S.Robotics 429 VENDOR Infinite-Networks 541 VENDOR Ascend 529 dictionary.ascend VENDOR Alcatel 800 VENDOR Scorpion 905 VENDOR Bay-Networks 1584 VENDOR Lucent 1751 VENDOR RedBack 2352 VENDOR Aptis 2634 VENDOR MasterSoft 5401

10 VENDOR 3GPP VENDOR Quintum 6618 VENDOR 3GPP VENDOR Accense dictionary.accense dictionary dictionary.hcl : VENDOR Hitachi-Cable 278 dictionary.hcl fullflex EG-7 RADIUS : [fullflex ]/conf/ - dictionary - dictionary.hcl fullflex Hitach-Cable:NA-Vlan-Id = 20 RADIUS RADIUS : apresia13000 IP: : apresia : < > : MACApresia X24-PSR MAC rduser : rduser : rdpassword : : Login Administrator :

11 Service-Type = 6 v10 : v10 : password : : Web Web/MAC : Hitach-Cable:NA-Vlan-Id = 10 v20 : v20 : password : : Web : Hitach-Cable:NA-Vlan-Id = 20 dot1x20 : dot1x20 : password : : 802.1x : Tunnel-Type = 13 Tunnel-Medium-Type = 6 Tunnel-Private-Group-Id = a9902fea : 0013a9902fea : 1q2w3e : : MACv10MAC OS: Windows 7 Ultimate (32bit) MAC: 00:13:A9:90:2F:EA

12 : Hitach-Cable:NA-Vlan-Id = 10 : <> : support : Accense Technology, Inc. : Osaka : Osaka : JP : 365

13 P.359 RADIUS : (config)# radius login enable RADIUS : (config)# radius login primary ip port RADIUS secret key : (config)# radius login primary secret-key apresia show radius login configuration: # show radius login configuration RADIUS Login Authentication Configuration: Authentication Status : enable Local Authentication Status : enable Server Request Interval : 3 Server Max Request : 3 Primary Radius Server Configuration: IP Address : Port Number : Secret Key (Encrypted) : NVPYrO9vB1d+QigidzZmwA$$ Secondary Radius Server Configuration: IP Address : Port Number : 1812 Secret Key (Encrypted) : # fullflex EG rduser adpro # configure terminal

14 fullflex EG rduser telnet >enagle # configure terminal APRESIA telnet login: [~]$ telnet Trying Connected to Escape character is '^]'. login: rduser Password: > enable # configure terminal Enter configuration commands, one per line. End with CNTL/Z. (config)# show logging reverse: Jan 18 14:06:08 <cli:info> enable Jan 18 14:06:04 <cli:notice> Login rduser from Jan 18 14:06:04 <cli:info> RADIUS( ) Authentication succeeded. fullflex EG : [18121] :65521 >> Access-Request id(209) : len(78) : authenticator(d0459f2d232311ee326a08a73becf64e) User-Name = "rduser" User-Password = <f 7c c8 91 ff e6 b0 86 7b 3a d1 d8 y b6 ^ L> NAS-IP-Address = NAS-Port = 1 NAS-Port-Type = Virtual Calling-Station-Id = " " [18121] :65521 << Access-Accept id(209) : len(26) : authenticator(bb985fdef5f0f8e0500e8e1ed90488d8) Service-Type = Administrative

15 Web 6.1 WebP.67 - VLAN fullflex WebLAN Web 22 Web RADIUS: (config)# aaa radius 1 host auth-port key apresia (config)# aaa authentication web radius 1 : (config)# access-defender (4 ): (config-a-def)# packet-filter2 max-rule 4 Web : (config-a-def)# web-authentication port 22 URL( (config-a-def)# web-authentication ip (config-a-def)# web-authentication http-port 80 :300: (config-a-def)# logout aging-time 300 Web: (config-a-def)# exit (config)# web-authentication enable (config)# exit # write memory show access-defender port-configuration: # show access-defender port-configuration AccessDefender Port Configuration: web = web-authentication, gateway = web-authentication gateway mac = mac-authentication, 802.1X = IEEE802.1X, DHCPSNP = DHCP snooping,

16 LD LO = Linkdown Logout, o = enable, x = disable Port : : : web : o..... gateway: mac : o X : o.... DHCPSNP: roaming: LD LO : show running-config: # show running-config username adpro adpro username user user radius login enable radius login primary ip port radius login primary encrypted-secret-key NVPYrO9vB1d+QigidzZmwA$$ packet-filter2 2 assign port condition ipv4 dst tcp/udp 67 udp 2 1 action authentication-bypass no ip multicast-routing vlan database vlan 10 name v10 vlan 20 name v20 vlan 100 name mgmt vlan 192 name server vlan 4094 name temp interface loopback interface manage ip address /24 interface port 1 interface port 2 interface port 3 interface port 4 interface port 5 interface port 6 interface port 7 interface port 8 interface port 9 interface port 10 interface port 11 interface port 12 interface port 13 interface port 14 interface port 15 interface port 16 interface port 17

17 interface port 18 interface port 19 interface port 20 interface port 21 media utp switchport access vlan 4094 interface port 22 media utp switchport access vlan 4094 interface port 23 media utp switchport access vlan 4094 interface port 24 media utp switchport access vlan 192 interface port 25 interface port 26 interface port 27 interface port 28 interface vlan 1 interface vlan 10 ip address /24 interface vlan 20 ip address /24 interface vlan 100 ip address /24 interface vlan 192 ip address /24 interface vlan 4094 ip address /16 ip route / dhcp policy temp network /16 range router lease 10 dhcp policy v10 network /24 range router dhcp policy v20 network /24 range router dhcp policy enable temp dhcp policy enable v10 dhcp policy enable v20 dhcp server address-check arp dhcp server enable aaa radius 1 host auth-port encrypted-key NVPYrO9vB1d+Qigidz ZmwA$$ aaa authentication web radius 1 aaa authentication mac radius 1 aaa authentication dot1x radius 1 access-defender packet-filter2 max-rule 4

18 web-authentication port 22 web-authentication ip web-authentication http-port 80 mac-authentication port 21 mac-authentication encrypted-password DQ0XYTu4/Jl+QigidzZmwA$$ dot1x port 23 dot1x port 23 reauthentication logout aging-time web-authentication enable end 22Web fullflex v10 fullflex VLANDHCP IP v10/password login 3. fullflex 4. APRESIA fullflex VLAN DHCP IP fullflex fullflex Access- Request APRESIAfullflex VLAN DHCP IP IPAPRESIA DHCP

19

20 APRESIA show logging reverse: # show logging reverse Date Log messages Jan 18 17:10:28 <cli:info> show logging reverse Jan 18 17:10:27 <process:notice> A-Def : web : logout(link down) : uid=v10 mac =00:13:a9:90:2f:ea ip= port=22 vid=4094 new vid=10 Jan 18 17:10:23 <port:err> Port 22 link down. Jan 18 17:10:16 <cli:info> show logging reverse Jan 18 17:10:01 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (ki tahama7) via vlan10 Jan 18 17:10:01 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9:90:2f:ea (kitahama7) via vlan10 Jan 18 17:10:01 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea ( kitahama7) via vlan10 Jan 18 17:10:00 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan10 Jan 18 17:09:54 <cli:info> show logging reverse Jan 18 17:09:52 <process:notice> A-Def : web : login succeeded : uid=v10 mac=0 0:13:a9:90:2f:ea ip= port=22 vid=4094 new vid=10 Jan 18 17:09:51 <process:notice> A-Def : radius authentication succeeded : uid =v10 Jan 18 17:09:43 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 17:09:43 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9 :90:2f:ea (kitahama7) via vlan4094 Jan 18 17:09:43 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea (kitah ama7) via vlan4094 Jan 18 17:09:43 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan4094 Jan 18 17:09:20 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 17:09:20 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9 :90:2f:ea (kitahama7) via vlan4094 Jan 18 17:09:20 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea (kitah ama7) via vlan4094 Jan 18 17:09:20 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan4094 Jan 18 17:08:55 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 17:08:55 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9 :90:2f:ea (kitahama7) via vlan4094 Jan 18 17:08:55 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea (kitah

21 ama7) via vlan4094 Jan 18 17:08:55 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan4094 Jan 18 17:08:43 <cli:info> show logging reverse Jan 18 17:08:32 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 17:08:32 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9 :90:2f:ea (kitahama7) via vlan4094 Jan 18 17:08:32 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea (kitah ama7) via vlan4094 Jan 18 17:08:31 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan4094 Jan 18 17:08:30 <cli:info> show logging reverse Jan 18 17:08:24 <cli:info> show logging reverse Jan 18 17:08:11 <cli:info> show logging reverse Jan 18 17:08:02 <cli:info> show logging reverse Jan 18 17:07:54 <cli:info> show logging reverse Jan 18 17:07:31 <port:warning> Port 22 link up 100BASE-TX, full-duplex, MDI-X. fullflex EG : [18121] :65470 >> Access-Request id(3) : len(75) : authenticator(c238fc214a1ea f7a00821be) User-Name = "v10" User-Password = <x a5 r b1 c0 Y h B 0f Z E k 0b b2 U 2a> NAS-Port = 22 Calling-Station-Id = "0013a9902fea" NAS-Identifier = "4094" NAS-IP-Address = [18121] :65470 << Access-Accept id(3) : len(32) : authenticator(9d404c8d1188c2bd5e932df080db2c0e) Vendor-Specific = Hitachi-Cable(278) Hitachi-Cable:NA-Vlan-Id = 10 IPv

22 MAC 6.2 MACP.70 - VLAN fullflex MACfullflex MAC MAC 21 RADIUS: (config)# aaa radius 1 host auth-port key apresia (config)# aaa authentication mac radius 1 : (config)# access-defender 4 : (config-a-def)# packet-filter2 max-rule 4 MAC 21: (config-a-def)# mac-authentication port 21 MAC : (config-a-def)# mac-authentication password 1q2w3e MAC: (config-a-def)# exit (config)# mac-authentication enable (config)# exit # write memory

23 show access-defender port-configuration: # show access-defender port-configuration AccessDefender Port Configuration: web = web-authentication, gateway = web-authentication gateway mac = mac-authentication, 802.1X = IEEE802.1X, DHCPSNP = DHCP snooping, LD LO = Linkdown Logout, o = enable, x = disable Port : : : web : gateway: mac : o X : DHCPSNP: roaming: LD LO : show running-config: # show running-config username adpro adpro username user user radius login enable radius login primary ip port radius login primary encrypted-secret-key NVPYrO9vB1d+QigidzZmwA$$ packet-filter2 2 assign port condition ipv4 dst tcp/udp 67 udp 2 1 action authentication-bypass no ip multicast-routing vlan database vlan 10 name v10 vlan 20 name v20 vlan 100 name mgmt vlan 192 name server vlan 4094 name temp interface loopback interface manage ip address /24 interface port 1 interface port 2 interface port 3 interface port 4 interface port 5 interface port 6 interface port 7

24 interface port 8 interface port 9 interface port 10 interface port 11 interface port 12 interface port 13 interface port 14 interface port 15 interface port 16 interface port 17 interface port 18 interface port 19 interface port 20 interface port 21 media utp switchport access vlan 4094 interface port 22 media utp switchport access vlan 4094 interface port 23 media utp switchport access vlan 4094 interface port 24 media utp switchport access vlan 192 interface port 25 interface port 26 interface port 27 interface port 28 interface vlan 1 interface vlan 10 ip address /24 interface vlan 20 ip address /24 interface vlan 100 ip address /24 interface vlan 192 ip address /24 interface vlan 4094

25 ip address /16 ip route / dhcp policy temp network /16 range router lease 10 dhcp policy v10 network /24 range router dhcp policy v20 network /24 range router dhcp policy enable temp dhcp policy enable v10 dhcp policy enable v20 dhcp server address-check arp dhcp server enable aaa radius 1 host auth-port encrypted-key NVPYrO9vB1d+Qigidz ZmwA$$ aaa authentication mac radius 1 access-defender packet-filter2 max-rule 4 mac-authentication port 21 mac-authentication encrypted-password DQ0XYTu4/Jl+QigidzZmwA$$ mac-authentication enable end MACRADIUS RADIUS VLANDHCP IP fullflex MAC 3. APRESIA fullflex VLAN DHCP IP fullflex MACAccess-Request APRESIAfullflex VLAN DHCP IP

26 APRESIA IPAPRESIA DHCP show logging reverse: Jan 18 14:43:11 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (ki tahama7) via vlan10 Jan 18 14:43:11 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9:90:2f:ea (kitahama7) via vlan10 Jan 18 14:43:11 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea ( kitahama7) via vlan10 Jan 18 14:43:10 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan10 Jan 18 14:42:08 <process:notice> A-Def : mac : login succeeded : uid=0013a9902 fea mac=00:13:a9:90:2f:ea ip= port=21 vid=4094 new vid=10 Jan 18 14:42:08 <process:notice> A-Def : radius authentication succeeded : uid =0013a9902fea Jan 18 14:42:06 <port:warning> Port 21 link up 100BASE-TX, full-duplex, MDI-X. fullflex EG : [18121] :65507 >> Access-Request id(1) : len(84) : authenticator(bdc102a19b50be9f7f d0b6e) User-Name = "0013a9902fea" User-Password = <v A b7 R d9 2 t fa af O 88 be U 28> NAS-Port = 21 Calling-Station-Id = "0013a9902fea" NAS-Identifier = "4094" NAS-IP-Address = [18121] :65507 << Access-Accept id(1) : len(32) : authenticator(8af01e3bd2cbdc780bdc88cdc7127e97) Vendor-Specific = Hitachi-Cable(278) Hitachi-Cable:NA-Vlan-Id = 10 IPv

27

28 Web/MAC 6.3 Web/MAC P.72 VLAN fullflex Web MACLAN MAC MAC Web fullflex MAC fullflex MAC 21 RADIUS: (config)# aaa radius 1 host auth-port key apresia (config)# aaa authentication web radius 1 (config)# aaa authentication mac radius 1 (4 ): (config)# access-defender (config-a-def)# packet-filter2 max-rule 4 Web : (config-a-def)# web-authentication port 21 URL: (config-a-def)# web-authentication ip (config-a-def)# web-authentication http-port 80 MAC : (config-a-def)# mac-authentication port 21 (config-a-def)# mac-authentication password 1q2w3e :300:

29 (config-a-def)# logout aging-time 300 Web/MAC: (config)# web-authentication enable (config)# mac-authentication enable show access-defender port-configuration: # show access-defender port-configuration AccessDefender Port Configuration: web = web-authentication, gateway = web-authentication gateway mac = mac-authentication, 802.1X = IEEE802.1X, DHCPSNP = DHCP snooping, LD LO = Linkdown Logout, o = enable, x = disable Port : : : web : oo..... gateway: mac : o X : o.... DHCPSNP: roaming: LD LO : # show running-config username adpro adpro username user user radius login enable radius login primary ip port radius login primary encrypted-secret-key NVPYrO9vB1d+QigidzZmwA$$ packet-filter2 2 assign port condition ipv4 dst tcp/udp 67 udp 2 1 action authentication-bypass no ip multicast-routing vlan database vlan 10 name v10 vlan 20 name v20 vlan 100 name mgmt vlan 192 name server vlan 4094 name temp interface loopback interface manage ip address /24 interface port 1

30 interface port 2 interface port 3 interface port 4 interface port 5 interface port 6 interface port 7 interface port 8 interface port 9 interface port 10 interface port 11 interface port 12 interface port 13 interface port 14 interface port 15 interface port 16 interface port 17 interface port 18 interface port 19 interface port 20 interface port 21 media utp switchport access vlan 4094 interface port 22 media utp switchport access vlan 4094 interface port 23 media utp switchport access vlan 4094 interface port 24 media utp switchport access vlan 192 interface port 25 interface port 26 interface port 27 interface port 28 interface vlan 1 interface vlan 10

31 ip address /24 interface vlan 20 ip address /24 interface vlan 100 ip address /24 interface vlan 192 ip address /24 interface vlan 4094 ip address /16 ip route / dhcp policy temp network /16 range router lease 10 dhcp policy v10 network /24 range router dhcp policy v20 network /24 range router dhcp policy enable temp dhcp policy enable v10 dhcp policy enable v20 dhcp server address-check arp dhcp server enable aaa radius 1 host auth-port encrypted-key NVPYrO9vB1d+Qigidz ZmwA$$ aaa authentication web radius 1 aaa authentication mac radius 1 aaa authentication dot1x radius 1 access-defender packet-filter2 max-rule 4 web-authentication port web-authentication ip web-authentication http-port 80 mac-authentication port 21 mac-authentication encrypted-password DQ0XYTu4/Jl+QigidzZmwA$$ dot1x port 23 dot1x port 23 reauthentication logout aging-time web-authentication enable mac-authentication enable end 1. 21MAC RADIUS

32 2. 21MAC RADIUS 3. Web 4. fullflex v10 fullflex VLAN DHCP IP 5. MAC RADIUS fullflexmac 7. APRESIA fullflex VLAN DHCP IP MAC RADIUS APRESIAMAC v10/password login 13. fullflex 14. APRESIA fullflex VLAN DHCP IP APRESIA MAC RADIUS fullflex MAC Access-Request APRESIA MACfullflex VLAN DHCP IP MACIPAPRESIA DHCP MAC RADIUSAPRESIA MAC MAC fullflex fullflex Access- Request APRESIAfullflex VLAN DHCP IP IPAPRESIA DHCP

33 MAC show logging reverse: # show logging reverse Date Log messages Jan 18 18:58:48 <cli:info> show logging reverse Jan 18 18:58:22 <process:notice> A-Def : mac : logout(link down) : uid=0013a99 02fea mac=00:13:a9:90:2f:ea ip= port=21 vid=4094 new vid=10 Jan 18 18:58:20 <port:err> Port 21 link down. Jan 18 18:58:00 <cli:info> show logging reverse Jan 18 18:57:50 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (ki tahama7) via vlan10 Jan 18 18:57:50 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9:90:2f:ea (kitahama7) via vlan10 Jan 18 18:57:50 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea ( kitahama7) via vlan10 Jan 18 18:57:49 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan10 Jan 18 18:57:42 <cli:info> show logging reverse Jan 18 18:57:28 <process:notice> A-Def : mac : login succeeded : uid=0013a9902 fea mac=00:13:a9:90:2f:ea ip= port=21 vid=4094 new vid=10 Jan 18 18:57:27 <process:notice> A-Def : radius authentication succeeded : uid =0013a9902fea Jan 18 18:57:25 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 18:57:25 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9 :90:2f:ea (kitahama7) via vlan4094 Jan 18 18:57:25 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea (kitah ama7) via vlan4094 Jan 18 18:57:25 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan4094 Jan 18 18:57:24 <port:warning> Port 21 link up 100BASE-TX, full-duplex, MDI-X. MAC show logging reverse: # show logging reverse Date Log messages Jan 18 19:18:27 <cli:info> show logging reverse Jan 18 19:18:22 <process:notice> A-Def : web : logout(link down) : uid=v10 mac =00:0b:5d:7c:6e:2e ip= port=21 vid=4094 new vid=10 Jan 18 19:18:20 <port:err> Port 21 link down. Jan 18 19:18:14 <dhcp:info> DHCPACK on to 00:0b:5d:7c:6e:2e (XP 100-OSAKA) via vlan10 Jan 18 19:18:14 <dhcp:info> DHCPREQUEST for ( ) from 00:0b:5d:7c:6e:2e (XP100-OSAKA) via vlan10 Jan 18 19:18:14 <dhcp:info> DHCPOFFER on to 00:0b:5d:7c:6e:2e ( XP100-OSAKA) via vlan10 Jan 18 19:18:13 <dhcp:info> DHCPDISCOVER from 00:0b:5d:7c:6e:2e via vlan10 Jan 18 19:18:12 <dhcp:info> DHCPACK on to 00:0b:5d:7c:6e:2e (XP100-O SAKA) via vlan10 Jan 18 19:18:12 <dhcp:info> DHCPREQUEST for from 00:0b:5d:7c:6e:2e v ia vlan10 Jan 18 19:18:10 <cli:info> show logging reverse Jan 18 19:18:02 <dhcp:info> DHCPACK on to 00:0b:5d:7c:6e:2e (XP100-O SAKA) via vlan10 Jan 18 19:18:02 <dhcp:info> DHCPREQUEST for from 00:0b:5d:7c:6e:2e ( XP100-OSAKA) via vlan10 Jan 18 19:18:01 <cli:info> show logging reverse Jan 18 19:17:59 <process:notice> A-Def : web : login succeeded : uid=v10 mac=0

34 0:0b:5d:7c:6e:2e ip= port=21 vid=4094 new vid=10 Jan 18 19:17:58 <process:notice> A-Def : radius authentication succeeded : uid =v10 Jan 18 19:17:56 <dhcp:info> DHCPACK on to 00:0b:5d:7c:6e:2e (XP100-O SAKA) via vlan4094 Jan 18 19:17:56 <dhcp:info> DHCPREQUEST for from 00:0b:5d:7c:6e:2e ( XP100-OSAKA) via vlan4094 Jan 18 19:17:52 <dhcp:info> DHCPACK on to 00:0b:5d:7c:6e:2e (XP100-O SAKA) via vlan4094 Jan 18 19:17:52 <dhcp:info> DHCPREQUEST for ( ) from 00:0b:5d :7c:6e:2e (XP100-OSAKA) via vlan4094 Jan 18 19:17:52 <dhcp:info> DHCPOFFER on to 00:0b:5d:7c:6e:2e (XP100 -OSAKA) via vlan4094 Jan 18 19:17:51 <dhcp:info> DHCPDISCOVER from 00:0b:5d:7c:6e:2e via vlan4094 Jan 18 19:17:45 <cli:info> show logging reverse Jan 18 19:17:39 <cli:info> show logging reverse Jan 18 19:17:24 <cli:info> show logging reverse Jan 18 19:17:15 <process:notice> A-Def : mac : login failed : uid=000b5d7c6e2e mac=00:0b:5d:7c:6e:2e ip= port=21 vid=4094 Jan 18 19:17:15 <process:notice> A-Def : radius authentication failed : uid=00 0b5d7c6e2e Jan 18 19:17:12 <cli:info> show logging reverse Jan 18 19:17:09 <port:warning> Port 21 link up 100BASE-TX, full-duplex, MDI-X. fullflex EG MAC : [18121] :65449 >> Access-Request id(5) : len(84) : authenticator(c7aff6a2f9eb8a31cb4c6fabaa83370e) User-Name = "0013a9902fea" User-Password = <c5 x 3a l ed 8e 2d bc 19 bf 04 v w e6 86 3c> NAS-Port = 21 Calling-Station-Id = "0013a9902fea" NAS-Identifier = "4094" NAS-IP-Address = [18121] :65449 << Access-Accept id(5) : len(32) : authenticator(782b323d51422e85b1100fb054c9828d) Vendor-Specific = Hitachi-Cable(278) Hitachi-Cable:NA-Vlan-Id = 10 MAC : [18121] :65393 >> Access-Request id(11) : len(84) : authenticator(d614e c8cbd5d9cc7c8f479fe) User-Name = "000b5d7c6e2e" User-Password = <c fe y p 1e d8 ee bb ce w 0a 8 c9 e1 e8 f7> NAS-Port = 21 Calling-Station-Id = "000b5d7c6e2e" NAS-Identifier = "4094" NAS-IP-Address = [18121] :65393 << Access-Reject id(11) : len(20) : authenticator(875b3b18d31f9a389bc ) [18121] :65384 >> Access-Request

35 id(12) : len(75) : authenticator(59d061e6de3baff09060a3214db284a6) User-Name = "v10" User-Password = <aa b8 q v c7 ff z d6 ab b5 3 f2 dd /> NAS-Port = 21 Calling-Station-Id = "000b5d7c6e2e" NAS-Identifier = "4094" NAS-IP-Address = [18121] :65384 << Access-Accept id(12) : len(32) : authenticator(073fb0d82508aa6e856d60e77a6502d9) Vendor-Specific = Hitachi-Cable(278) Hitachi-Cable:NA-Vlan-Id = 10 MAC IPv MAC MAC IP

36 MAC Web IP

37 IEEE 802.1x XP.81 - VLAN fullflex Windows 7 Ultimate dot1x20eap-tls PEAP 802.1x 23 RADIUS: (config)# aaa radius 1 host auth-port key apresia (config)# aaa authentication dot1x radius 1 : (config)# access-defender 4 : (config-a-def)# packet-filter2 max-rule 4 : (config-a-def)# dot1x port 23 : (config-a-def)# dot1x port 23 reauthentication 802.1X: (config-a-def)# exit (config)# dot1x enable (config)# exit # write memory show running-config: # show running-config username adpro adpro username user user radius login enable radius login primary ip port radius login primary encrypted-secret-key NVPYrO9vB1d+QigidzZmwA$$

38 packet-filter2 2 assign port condition ipv4 dst tcp/udp 67 udp 2 1 action authentication-bypass no ip multicast-routing vlan database vlan 10 name v10 vlan 20 name v20 vlan 100 name mgmt vlan 192 name server vlan 4094 name temp interface loopback interface manage ip address /24 interface port 1 interface port 2 interface port 3 interface port 4 interface port 5 interface port 6 interface port 7 interface port 8 interface port 9 interface port 10 interface port 11 interface port 12 interface port 13 interface port 14 interface port 15 interface port 16 interface port 17 interface port 18 interface port 19 interface port 20 interface port 21 media utp switchport access vlan 4094 interface port 22 media utp switchport access vlan 4094 interface port 23 media utp switchport access vlan 4094 interface port 24 media utp switchport access vlan 192 interface port 25

39 interface port 26 interface port 27 interface port 28 interface vlan 1 interface vlan 10 ip address /24 interface vlan 20 ip address /24 interface vlan 100 ip address /24 interface vlan 192 ip address /24 interface vlan 4094 ip address /16 ip route / dhcp policy temp network /16 range router lease 10 dhcp policy v10 network /24 range router dhcp policy v20 network /24 range router dhcp policy enable temp dhcp policy enable v10 dhcp policy enable v20 dhcp server address-check arp dhcp server enable aaa radius 1 host auth-port encrypted-key NVPYrO9vB1d+Qigidz ZmwA$$ aaa authentication mac radius 1 aaa authentication dot1x radius 1 access-defender packet-filter2 max-rule 4 mac-authentication port 21 mac-authentication encrypted-password DQ0XYTu4/Jl+QigidzZmwA$$ dot1x port 23 dot1x port 23 reauthentication dot1x enable end EAP-TLS 802.1xRADIUS VLANDHCP IP x TLS 1. fullflex EG 2. MMC Wired AutoConfig

40 IEEE 802.1X 8. Microsoft fullflex 802.1x 3. APRESIAfullflex VLAN DHCP IP EAP-TLS APRESIA fullflex TLS802.1x APRESIAfullflex VLAN DHCP IP IPAPRESIA DHCP show logging reverse: Jan 18 20:06:06 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (ki tahama7) via vlan20 Jan 18 20:06:06 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9:90:2f:ea (kitahama7) via vlan20 Jan 18 20:06:06 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea ( kitahama7) via vlan20 Jan 18 20:06:05 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea (kitahama7) vi a vlan20 Jan 18 20:05:01 <process:notice> A-Def : dot1x : login succeeded : uid=dot1x20 mac=00:13:a9:90:2f:ea ip= port=23 vid=4094 new vid=20 Jan 18 20:05:01 <process:notice> A-Def : radius authentication succeeded : uid =dot1x20 Jan 18 20:04:52 <port:warning> Port 23 link up 100BASE-TX, full-duplex, MDI-X. fullflex EG : [18121] :65255 >> Access-Request id(25) : len(105) : authenticator(f955baaccff4860a478505b40e52132f) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <s i 97 b5 fc b f8 b2 0 ae 8e b3 c8 bd> EAP-Message = Response/1/Identity/"dot1x20" NAS-IP-Address = [18121] :65255 << Access-Challenge id(25) : len(77) : authenticator(03ce1ef e20c86c95a87d58b) State = <K 3d d4 0d f2 bd dd cc b8 a p e a p 3a 1 20> Session-Timeout = 20 EAP-Message = Request/2/PEAP/" " Message-Authenticator = <y 03 O a9 9b 2b a3 ab 83 db bd 96 cf 1 e4 9d> [18121] :65246 >> Access-Request id(26) : len(124) : authenticator(7c11376da7dbf96e1a880c0e930f1ed7) User-Name = "dot1x20" NAS-Port = 23

41 Service-Type = Framed Framed-MTU = 1452 State = <K 3d d4 0d f2 bd dd cc b8 a p e a p 3a 1 20> Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <e6 d2 a5 96 9f e [ \ s \ 0a k e0 da> EAP-Message = Response/2/NAK/<0d> NAS-IP-Address = [18121] :65246 << Access-Challenge id(26) : len(85) : authenticator(f9244d1e2fecc97b78e4874a7c9bc4eb) State = <00 09 e a p 2d t l s / K 3d fd ed b3 Session-Timeout = 60 EAP-Message = Request/3/TLS/" " Message-Authenticator = <ec d5 05 da d8 9d ae q 25 7f r 27 9b da z bf> [18121] :65237 >> Access-Request id(27) : len(242) : authenticator(feccb42d7ec26cd3ed8a146818cd297f) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <00 09 e a p 2d t l s / K 3d fd ed b3 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <94 96 b e9 9f a d7 c7 X e3 c7 9d 9d L> EAP-Message = Response/3/TLS/< j e a K T NAS-IP-Address = [18121] :65237 << Access-Challenge id(27) : len(1541) : authenticator(ede51956ed887d e ) State = <00 09 e a p 2d t l s / K 3d fd ed b3 Session-Timeout = 60 EAP-Message = < ac 0d c da J F K EAP-Message = < J P 0 1e 17 0d Z 17 0d 1 9 EAP-Message = <5 f6 cb 18 K dc o u f3 93 f ce B 89 A 02 U 06 c i 1a EAP-Message = <95 1c d9 f5 e1 a f 1b fb S O 7f 95 af X ac 7c p EAP-Message = <s a k a 1 0e 0 0c U O s a k a 1 0b EAP-Message = <8e 3a 1e d 2c ce 9e M q d2 7c 26 t 89 ] 8f R 02 W f6 Y fc a 17 Message-Authenticator = <C fc ac 96 e1 a2 S 2a dc 81 e8 21 B d a9 17> [18121] :65228 >> Access-Request id(28) : len(132) : authenticator(818831ee56a9df37c08d1bc29d8a3427) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <00 09 e a p 2d t l s / K 3d fd ed b3 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = e9 09 ff 0e fc 13 bd fa 9f de ca fd k m> EAP-Message = Response/4/TLS/<00> NAS-IP-Address = [18121] :65228 << Access-Challenge id(28) : len(657) : authenticator(5902ee97b2b5869da041c36a57a801e6) State = <00 09 e a p 2d t l s / K 3d fd ed b3 Session-Timeout = 60 EAP-Message = < e 0d 00 1d e7 B " s Y m ^ e3 16 f3 e4 l 99 9f e8 c9 2 EAP-Message = <0 0c U 1d ff 0 0b U 1d 0f EAP-Message = <14 3b a9 b4 f4 b1 cb 7b 17 A 8c 82 f1 7c 3a 12 9c 85 a6 7d r a5 Message-Authenticator = <4 af 08 ea / b6 b8 93 da 3c 9e cf c8 08 f4 2a> [18121] :65219 >> Access-Request id(29) : len(1263) : authenticator(0344aeae2d90529c c22483fcf) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <00 09 e a p 2d t l s / K 3d fd ed b3 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <V b2 fc 98 9b y e3 f2 1f 9c 8c c \ 19 B H> EAP-Message = < i 0d _ f 0b f c EAP-Message = <05 O s a k a 1 0c 0 0a U 04 0a A T I 1 0c 0 0a 06 0 EAP-Message = <U 1d 0f a U 1d d 06 EAP-Message = <ce 23 8b fc b f5 cf ac b9 99 dc bf fa aa ed bd e1 fd 92 d EAP-Message = <c8 1a df 9f 91 ed 8b 0e w ed Z 9b 7c db be 25 ae fe NAS-IP-Address = [18121] :65219 << Access-Challenge id(29) : len(148) : authenticator(1236edfbfa9fca508052a67a7ec4885e) State = <00 09 e a p 2d t l s / K 3d fd ed b3 Session-Timeout = 60 EAP-Message = Request/6/TLS/< b d

42 Message-Authenticator = <ec cd 9d b0 C b 8b a6 13 7f I af b3 a6. "> [18121] :65210 >> Access-Request id(30) : len(132) : authenticator(86ff2b6f0577c a76a7054a77) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <00 09 e a p 2d t l s / K 3d fd ed b3 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <0c da be ed \ A d7 C a2 7f 3c C 2b 24> EAP-Message = Response/6/TLS/<00> NAS-IP-Address = [18121] :65210 << Access-Accept id(30) : len(188) : authenticator(ef5a7d4977f41bd5d2f40bd b) Termination-Action = RADIUS-Request Session-Timeout = 3600 Vendor-Specific = Microsoft(311) Microsoft:17 = <d4 d0 cd N 1f ec r e de f7 e7 e dd 10 d9 cd h Vendor-Specific = Microsoft(311) Microsoft:16 = <9c e5 28 / f8 a6 c9 S d5 e2 cd " f1 16 c1 c3 Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "20" EAP-Message = Success/7 Message-Authenticator = <7b 81 Y 1 d0 3f e4 c5 K L R e9 09 V 8d f4> IPv PEAP 802.1xRADIUS VLANDHCP IP x PEAP 1. fullflex EG

43 2. MMC Wired AutoConfig IEEE 802.1X 8. Microsoft EAP PEAP EAP- MSCHAP v2 11. Windows 2. fullflex 802.1x 3. APRESIAfullflex VLAN DHCP IP PEAP APRESIA fullflex PEAP802.1x APRESIAfullflex VLAN DHCP IP IPAPRESIA DHCP show logging reverse: Jan 18 20:20:57 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (ki tahama7) via vlan20 Jan 18 20:20:57 <dhcp:info> DHCPREQUEST for ( ) from 00:13:a9:90:2f:ea (kitahama7) via vlan20 Jan 18 20:20:57 <dhcp:info> DHCPOFFER on to 00:13:a9:90:2f:ea ( kitahama7) via vlan20 Jan 18 20:20:56 <process:notice> A-Def : dot1x : login succeeded : uid=dot1x20 mac=00:13:a9:90:2f:ea ip= port=23 vid=4094 new vid=20 Jan 18 20:20:56 <dhcp:info> DHCPDISCOVER from 00:13:a9:90:2f:ea via vlan20 Jan 18 20:20:55 <process:notice> A-Def : radius authentication succeeded : uid =dot1x20 Jan 18 20:20:38 <dhcp:info> DHCPACK on to 00:13:a9:90:2f:ea (kitaham a7) via vlan4094 Jan 18 20:20:38 <dhcp:info> DHCPREQUEST for from 00:13:a9:90:2f:ea ( kitahama7) via vlan4094 fullflex EG : [18121] :65021 >> Access-Request id(51) : len(105) : authenticator(3a616c39b266343eb5cec8d ) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <bd 16 d 9a N E be 9f 81 f0 R df e2 9e 86 Z> EAP-Message = Response/11/Identity/"dot1x20" NAS-IP-Address =

44 [18121] :65021 << Access-Challenge id(51) : len(85) : authenticator(bd6e90ab0625eb563325bc6e73e0df17) State = <00 09 e a p 2d t l s / K T C f ef O 06 ce I c Session-Timeout = 60 EAP-Message = Request/12/TLS/" " Message-Authenticator = <b4 T 1d \ f 90 a7 b1 n a0 6 7e _ a5> [18121] :65012 >> Access-Request id(52) : len(132) : authenticator(bd1ce9f98a4da7a288d1cf32154f3ce8) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <00 09 e a p 2d t l s / K T C f ef O 06 ce I c Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <f2 dd b4 " W da aa 2b 99 db B 7e 7e b5> EAP-Message = Response/12/NAK/<19> NAS-IP-Address = [18121] :65012 << Access-Challenge id(52) : len(77) : authenticator(507d41eda236dd00298eae3f5e730865) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 1 20> Session-Timeout = 20 EAP-Message = Request/13/PEAP/" " Message-Authenticator = <97 14 c 89 A b3 de b8 6 d1 fd 26 b7 00 d5 29> [18121] :65003 >> Access-Request id(53) : len(234) : authenticator(3fd866ba61341a075bd4d78c9a0c4790) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 1 20> Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <ba c9 20 b7 / b2 9d z 06 p p d e4 60 ef m> EAP-Message = Response/13/PEAP/< j e a K NAS-IP-Address = [18121] :65003 << Access-Challenge id(53) : len(1533) : authenticator(d25afcecc5837e6c3ba842ae1b373814) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 2 20> Session-Timeout = 20 EAP-Message = <01 0e 05 ac 19 c d J F K EAP-Message = < J P 0 1e 17 0d Z 17 0d 1 9 EAP-Message = <5 f6 cb 18 K dc o u f3 93 f ce B 89 A 02 U 06 c i 1a EAP-Message = <95 1c d9 f5 e1 a f 1b fb S O 7f 95 af X ac 7c p EAP-Message = <s a k a 1 0e 0 0c U O s a k a 1 0b EAP-Message = <8e 3a 1e d 2c ce 9e M q d2 7c 26 t 89 ] 8f R 02 W f6 Y fc a 17 Message-Authenticator = <86 af f6 7b db / 6 ae / 3c e8 28 / 2 ab S> [18121] :64994 >> Access-Request id(54) : len(124) : authenticator(c293e37a391b8d6b2ed7dee61fca5238) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 2 20> Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <b1 r 93 e0 80 d ab c6 1c 85 f > EAP-Message = Response/14/PEAP/<00> NAS-IP-Address = [18121] :64994 << Access-Challenge id(54) : len(640) : authenticator(921aea4bf24010fa92b8b4bb95c35380) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 1 20> Session-Timeout = 20 EAP-Message = <01 0f d e7 B " s Y m ^ e3 16 f3 e4 l 99 9f e8 c9 2 EAP-Message = <0 0c U 1d ff 0 0b U 1d 0f EAP-Message = <14 3b a9 b4 f4 b1 cb 7b 17 A 8c 82 f1 7c 3a 12 9c 85 a6 7d r a5 Message-Authenticator = <f a e0 1c c w J a w 18 p J> [18121] :64985 >> Access-Request id(55) : len(326) : authenticator(444f603b100200d001dae640a4875de0) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 1 20> Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <[ a 1a 99 u X d0 b0 04 a9 11 a7 e7 y ac 0e> EAP-Message = Response/15/PEAP/< c

45 NAS-IP-Address = [18121] :64985 << Access-Challenge id(55) : len(140) : authenticator(538e4e6e61c7119ba92e27b97224b2c2) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 3 20> Session-Timeout = 20 EAP-Message = Request/16/PEAP/< b Message-Authenticator = <f0 1c n 3c 3b 1a cc d0 a8 b4 fd 9c bb 3f af 2> [18121] :64976 >> Access-Request id(56) : len(124) : authenticator(c70addfbe8e87334d4dced9a ) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 p e a p 3a 3 20> Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <08 N 16 db 3 f3 N ae fe c4 L \ 94 eb 1a 98> EAP-Message = Response/16/PEAP/<00> NAS-IP-Address = [18121] :64976 << Access-Challenge id(56) : len(127) : authenticator(7b9009a3da0730a52c1125cca2d3b912) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ p e a p _ v 0 3a 1 Session-Timeout = 20 EAP-Message = Request/17/PEAP/< f8 2b b k j N a7 97 dc Message-Authenticator = <fc 83 d8 s \ a U 89 3b y ca b6 17 I Y s> [18121] :64967 >> Access-Request id(57) : len(174) : authenticator(49c65abcbfcfe698a7dff5f4ae027330) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ p e a p _ v 0 3a 1 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <c6 80 L 7b 8b c0 ee f9 d3 ff e6 A 0a S 20 95> EAP-Message = Response/17/PEAP/< c c fd 5 b7 95 1e NAS-IP-Address = [18121] :64967 << Access-Challenge id(57) : len(172) : authenticator(032c36ede2b2b1a c8490d) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 1 Session-Timeout = 20 EAP-Message = Request/18/PEAP/< b 0d x d1 7b ca 0 12 _ z 1d 9 Message-Authenticator = <e6 3c f1 60 7f 90 S f5 7c ea 7d 8 26 cc 11 fe> [18121] :64958 >> Access-Request id(58) : len(251) : authenticator(cc81d77c97b659fd7ae2fc4e33c07ed8) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 1 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <] 9f ea c v e6 09 S G> EAP-Message = Response/18/PEAP/< E cc 1c 26 cc 89 cc d7 3e NAS-IP-Address = [18121] :64958 << Access-Challenge id(58) : len(188) : authenticator(ed9f8feca850afaf d94c1b97b) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 2 Session-Timeout = 20 EAP-Message = Request/19/PEAP/< P v 8b e0 c9 7f c4 d5 03 c 84 d9 Message-Authenticator = <7c e2 7b 16 fb 8a d f9 a5 ab a4 f3 ac 06> [18121] :64949 >> Access-Request id(59) : len(187) : authenticator(4e3d543d6e9dcc614de504a9b87d8980) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 2 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <aa e7 V 3f f0 c1 93 b9 q Z I e5 " d9 j A> EAP-Message = Response/19/PEAP/< fa 12 M b 7b V 24 1a c d2 C NAS-IP-Address = [18121] :64949 << Access-Challenge id(59) : len(140) : authenticator(d5446b db4b6c8c7f65e5795) State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 2 Session-Timeout = 20 EAP-Message = Request/20/PEAP/< f6 d5 ae ^ 27 1d aa d5 be /

46 Message-Authenticator = <a4 f dc c5 23 fa t 7d 7f D c 12 a8 fa V da> [18121] :64940 >> Access-Request id(60) : len(187) : authenticator(d1f8d1fd46843fc620e80b033d3b9428) User-Name = "dot1x20" NAS-Port = 23 Service-Type = Framed Framed-MTU = 1452 State = <K T C f d b6 e3 b0 2b 24 d8 fe 06 m s _ c h a p _ v 2 3a 2 Calling-Station-Id = "0013a9902fea" NAS-Port-Type = Ethernet Message-Authenticator = <bf f7. 0f 9d ec cf a fb p K 5 f3 fc 3b O> EAP-Message = Response/20/PEAP/< eb h 1a a8 j [ 2a ^ d7 s fc NAS-IP-Address = [18121] :64940 << Access-Accept id(60) : len(188) : authenticator(a6ba5c30d3f96eb8b483009fc97d4eb9) Termination-Action = RADIUS-Request Session-Timeout = 3600 Vendor-Specific = Microsoft(311) Microsoft:17 = <a8 X ca 94 b6 03 c8 27 s 08 n ea 28 Q d e0 c1 92 be Vendor-Specific = Microsoft(311) Microsoft:16 = <dc O y 9c x c5 f6 u C j d a c2 7f df 97 9e Tunnel-Type = VLAN Tunnel-Medium-Type = IEEE-802 Tunnel-Private-Group-ID = "20" EAP-Message = Success/21 Message-Authenticator = <h 87 a5 m 91 cf 1 cc 0c m 3d bf a > IPv