Results

1. Connect the wired device (in this case, the printer).



2. Using tcpdump, FortiAuthenticator shows receipt of an incoming authentication request (execute tcpdump host 10.1.2.27 -nnvvXS):

   tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes

   17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)

   10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157

   Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a

   User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint

   0x0000: 3030 3232 3638 3161 6631 6130

   NAS-Port Attribute (5), length: 6, Value: 70

   0x0000: 0000 0046

   EAP-Message Attribute (79), length: 19, Value: .

   0x0000: 0200 0011 0130 3032 3236 3831 6166 3161

   0x0010: 30

   Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x

   0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778

   Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442

   0x0000: 384f 322e 3178 3831 6661 3030 3235 3030

   0x0010: 3037 3834 3432

   NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0

   0x0000: 6765 2430 2f30 2f30 2e30

   Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0

   0x0000: 3030 2032 3220 3638 2031 6120 6631 2461

   0x0010: 30

   Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80

   0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38

   0x0010: 30

   NAS-Port-Type Attribute (61), length: 6, value: Ethernet

   0x0000: 0000 000f

3. On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.

The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

4. Continuing with the tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

   17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73)

   10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45

   Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2

   Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13

   0x0000: 0000 000d

   Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802

   0x0000: 0000 0006

   Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering

   0x0000: 656e 6769 6e65 6572 696e 67

   0x0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......

   0x0010: 0a01 021b 0714 ead2 0035 1880 0208 002d 5

   0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X..

   0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en

   0x0040: 6769 6e65 6572 696e 67 gineering

5. Post-authentication DHCP transaction is picked up by FortiAuthenticator

   The Switch CLI shows a successful dot1x session:

   root# run show dotlx interface ge-0/0/0.0

   802.1X Information:

   Interface Role State MAC address User

   ge-0/0/0.0 Authenticator Authenticated 00:22:68:1A:F1:A0 0022681af1a0

   The MAC address interface has been dynamically placed into correct VLAN:

   root# run show vlans engineering

   Name Tag Interfaces

   engineering 10

   ge-0/0/0.0*, ge-0/0/11.0*

   Additionally, the printer shows as available on the network:

   root# run show arp interface vlan.10

   MAC Address Address Name Interface Flags

   00:0c:29:5b:90:68 10.1.2.29 10.1.2.29 vlan.10 none

   6c:70:9f:d6:ae:al 10.1.2.220 10.1.2.220 vlan.10 none

   b8:53:ac:4a:d5:f5 10.1.2.221 10.1.2.221 vlan.10 none

   00:22:68:1a:fl:a0 10.1.2.224 10.1.2.224 vlan.10 none

   a4:c3:61:24:b9:07 10.1.2.228 10.1.2.228 vlan.10 none

   Total entries: 5

   {master:0}[edit]

   root* run ping 10.1.2.224

   PING 10.1.2.224 (10.1.2.224): 56 data bytes

   64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms

   64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms

   64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms

   --- 10.1.2.224 ping statistics ---

   3 packets transmitted, 3 packets received, 0% packet loss

   round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms