Case Study: STA 802.1X Authentication Fails Because the Response Packet from the RADIUS Server Does Not Carry the Message-Authenticator Attribute

Symptom

802.1X authentication and RADIUS authentication are configured on an AC. STAs fail to be authenticated after connecting to APs.

Relevant Alarms and Logs

None

Cause Analysis

The response packet sent by the RADIUS server does not carry the Message-Authenticator attribute.

Message-Authenticator is the No. 80 RADIUS attribute. It is used to authenticate and verify authentication packets to prevent spoofing of invalid packets. This attribute is mandatory for 802.1X+RADIUS authentication packets.

Procedure

1. Reproduce the fault and use the trace function to check the authentication packet exchange process.

   [AC] trace object mac-address sta-mac
   [AC] trace enable

   The command output shows that the STA does not receive the response packet from the RADIUS server.

   [BTRACE][2021/03/24 17:43:27][8448][RADIUS][xxxx-xxxx-xxxx]:
   Server Template: 5
   [User-Name                          ] [9 ] [1201958]
   [Message-Authenticator              ] [18] [cc 5b 11 e3 b2 ec a8 2a 5b 09 09 c1 10 ee 6c 79 ]
   [Called-Station-Id                  ] [26] [yy-yy-yy-yy-yy-yy:LY-NAC]
   [BTRACE][2021/03/24 17:43:27][8448][RADIUS][xxxx-xxxx-xxxx]:
   [BTRACE][2021/03/24 17:43:27][8448][RADIUS][xxxx-xxxx-xxxx]:Receive a illegal packet(Eap Authenticator error).
   [BTRACE][2021/03/24 17:43:29][8448][AAA][xxxx-xxxx-xxxx]:
   AAA receive AAA_RD_MSG_SERVERNOREPLY message(61) from RADIUS module(235).
   [BTRACE][2021/03/24 17:43:29][8448][AAA][xxxx-xxxx-xxxx]:Radius authentication has no response.
   [BTRACE][2021/03/24 17:43:29][8448][AAA][xxxx-xxxx-xxxx]:
   [AAA ERROR]authen finish,the authen fail code is:7,reason is:Radius authentication has no response.

2. Obtain and analyze packets using the packet obtaining tool. It is found that the response packets sent by the RADIUS server do not contain the Message-Authenticator attribute.

   The attribute carried in packets sent by the AC is displayed as follows:

3. Modify the configuration on the RADIUS server to ensure that authentication packets carry the Message-Authenticator attribute.