Fortinet black logo

Cookbook

Results

Copy Link
Copy Doc ID 52c06fe2-eb01-11eb-97f7-00505692583a:798443
Download PDF
  1. Connect the wired device (in this case, the printer).
  2. Using tcpdump, FortiAuthenticator shows receipt of an incoming authentication request (execute tcpdump host 10.1.2.27 -nnvvXS):

    tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes

    17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)

    10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157

    Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a

    User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint

    0x0000: 3030 3232 3638 3161 6631 6130

    NAS-Port Attribute (5), length: 6, Value: 70

    0x0000: 0000 0046

    EAP-Message Attribute (79), length: 19, Value: .

    0x0000: 0200 0011 0130 3032 3236 3831 6166 3161

    0x0010: 30

    Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x

    0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778

    Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442

    0x0000: 384f 322e 3178 3831 6661 3030 3235 3030

    0x0010: 3037 3834 3432

    NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0

    0x0000: 6765 2430 2f30 2f30 2e30

    Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0

    0x0000: 3030 2032 3220 3638 2031 6120 6631 2461

    0x0010: 30

    Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80

    0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38

    0x0010: 30

    NAS-Port-Type Attribute (61), length: 6, value: Ethernet

    0x0000: 0000 000f

  3. On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.
  4. The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

  5. Continuing with the tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

    17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73)

    10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45

    Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2

    Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13

    0x0000: 0000 000d

    Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802

    0x0000: 0000 0006

    Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering

    0x0000: 656e 6769 6e65 6572 696e 67

    0x0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......

    0x0010: 0a01 021b 0714 ead2 0035 1880 0208 002d 5

    0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X..

    0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en

    0x0040: 6769 6e65 6572 696e 67 gineering

  6. Post-authentication DHCP transaction is picked up by FortiAuthenticator

    The Switch CLI shows a successful dot1x session:

    root# run show dotlx interface ge-0/0/0.0

    802.1X Information:

    Interface Role State MAC address User

    ge-0/0/0.0 Authenticator Authenticated 00:22:68:1A:F1:A0 0022681af1a0

    The MAC address interface has been dynamically placed into correct VLAN:

    root# run show vlans engineering

    Name Tag Interfaces

    engineering 10

    ge-0/0/0.0*, ge-0/0/11.0*

    Additionally, the printer shows as available on the network:

    root# run show arp interface vlan.10

    MAC Address Address Name Interface Flags

    00:0c:29:5b:90:68 10.1.2.29 10.1.2.29 vlan.10 none

    6c:70:9f:d6:ae:al 10.1.2.220 10.1.2.220 vlan.10 none

    b8:53:ac:4a:d5:f5 10.1.2.221 10.1.2.221 vlan.10 none

    00:22:68:1a:fl:a0 10.1.2.224 10.1.2.224 vlan.10 none

    a4:c3:61:24:b9:07 10.1.2.228 10.1.2.228 vlan.10 none

    Total entries: 5

    {master:0}[edit]

    root* run ping 10.1.2.224

    PING 10.1.2.224 (10.1.2.224): 56 data bytes

    64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms

    64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms

    64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms

    --- 10.1.2.224 ping statistics ---

    3 packets transmitted, 3 packets received, 0% packet loss

    round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms

  1. Connect the wired device (in this case, the printer).
  2. Using tcpdump, FortiAuthenticator shows receipt of an incoming authentication request (execute tcpdump host 10.1.2.27 -nnvvXS):

    tcpdump: listening on port1, link-type EN10MB (Ethernet), capture size 262144 bytes

    17:36:19.110399 IP (tos 0x0, ttl 64, id 18417, offset 0, flags [none], proto UDP (17), length 185)

    10.1.2.27.60114 > 10.1.2.29.1812: [udp sum ok] RADIUS, length: 157

    Access-Request (1), id: 0x08, Authenticator: b77fe0657747891fc8d53ae0ad2b0e7a

    User-Name Attribute (1), length: 14, Value: 0022681af1a0 #Switch forces username to be endpoint MAC address, no configuration needed on endpoint

    0x0000: 3030 3232 3638 3161 6631 6130

    NAS-Port Attribute (5), length: 6, Value: 70

    0x0000: 0000 0046

    EAP-Message Attribute (79), length: 19, Value: .

    0x0000: 0200 0011 0130 3032 3236 3831 6166 3161

    0x0010: 30

    Message-Authenticator Attribute (80), length: 18, Value: .y{.j.%..9|es.'x

    0x0000: a679 7b82 6344 2593 f639 7c65 73eb 2778

    Acct-Session-Id Attribute (44), length: 24, value: 802.1x81fa002500078442

    0x0000: 384f 322e 3178 3831 6661 3030 3235 3030

    0x0010: 3037 3834 3432

    NAS-Port-rd Attribute (87), length: 12, Value: ge-0/0/0.0

    0x0000: 6765 2430 2f30 2f30 2e30

    Calling-Station-Id Attribute (31), length: 19, value: 00-22-68-1a-fl-a0

    0x0000: 3030 2032 3220 3638 2031 6120 6631 2461

    0x0010: 30

    Called-Station-Id Attribute (30), length: 19, Value: a8-40-e5-b0-21-80

    0x0000: 6138 2464 3024 6535 2d62 302d 3231 2d38

    0x0010: 30

    NAS-Port-Type Attribute (61), length: 6, value: Ethernet

    0x0000: 0000 000f

  3. On the FortiAuthenticator, go to Logging > Log Access > Logs to verify the device authentication.
  4. The Debug Log (at https://<fac-ip>/debug/radius) should also confirm successful authentication.

  5. Continuing with the tcpdump, authentication is accepted from FortiAuthenticator and authorization attributes returned to the switch:

    17:36:19.115264 IP (tos Ox0, ttl 64, id 49111, offset 0, flags [none], proto UDP (17), length 73)

    10.1.2.29.1812 > 10.1.2.27.60114: (bad udp cksum 0x1880 -> 0x5ccel] RADIUS, length: 45

    Access-Accept (2), id: 0x08, Authenticator: b5c7b1bb5a316fb483a622eaae58ccc2

    Tunnel-Type Attribute (64), length: 6, Value: Tag[Unused] #13

    0x0000: 0000 000d

    Tunnel-Medium-Type Attribute (65), length: 6, Value: Tag[Unused] 802

    0x0000: 0000 0006

    Tunnel-Private-Group-ID Attribute (81), length: 13, Value: engineering

    0x0000: 656e 6769 6e65 6572 696e 67

    0x0000: 4500 0049 bfd7 0000 4011 a293 0a01 021d E..I....@ .......

    0x0010: 0a01 021b 0714 ead2 0035 1880 0208 002d 5

    0x0020: b5c7 blbb 5a31 6fb4 83a6 22ea ae58 ccc2 ....21o..."..X..

    0x0030: 4006 0000 0000 4106 0000 0006 510d 656e @ A Q en

    0x0040: 6769 6e65 6572 696e 67 gineering

  6. Post-authentication DHCP transaction is picked up by FortiAuthenticator

    The Switch CLI shows a successful dot1x session:

    root# run show dotlx interface ge-0/0/0.0

    802.1X Information:

    Interface Role State MAC address User

    ge-0/0/0.0 Authenticator Authenticated 00:22:68:1A:F1:A0 0022681af1a0

    The MAC address interface has been dynamically placed into correct VLAN:

    root# run show vlans engineering

    Name Tag Interfaces

    engineering 10

    ge-0/0/0.0*, ge-0/0/11.0*

    Additionally, the printer shows as available on the network:

    root# run show arp interface vlan.10

    MAC Address Address Name Interface Flags

    00:0c:29:5b:90:68 10.1.2.29 10.1.2.29 vlan.10 none

    6c:70:9f:d6:ae:al 10.1.2.220 10.1.2.220 vlan.10 none

    b8:53:ac:4a:d5:f5 10.1.2.221 10.1.2.221 vlan.10 none

    00:22:68:1a:fl:a0 10.1.2.224 10.1.2.224 vlan.10 none

    a4:c3:61:24:b9:07 10.1.2.228 10.1.2.228 vlan.10 none

    Total entries: 5

    {master:0}[edit]

    root* run ping 10.1.2.224

    PING 10.1.2.224 (10.1.2.224): 56 data bytes

    64 bytes from 10.1.2.224: icmp_seq=0 tt1=128 time=2.068 ms

    64 bytes from 10.1.2.224: icmp_seq=1 tt1=128 time=2.236 ms

    64 bytes from 10.1.2.224: icmp_seq=2 tt1=128 time=2.699 ms

    --- 10.1.2.224 ping statistics ---

    3 packets transmitted, 3 packets received, 0% packet loss

    round-trip min/avg/max/stddev = 2.068/2.334/2.699/0.267 ms