Netzwerk Zugangskontrolle mit 802.1x und FreeRadius am LAN Switch

Switch#
May 23 18:57:18.650: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/14, changed state to down
May 23 18:57:20.655: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/14, changed state to up
May 23 18:57:24.254: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/14, changed state to down
May 23 18:57:25.252: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/14, changed state to down
May 23 18:57:26.376: AAA/AUTHEN/8021X (00000000): Pick method list 'default'  
May 23 18:57:26.376: AAA/AUTHEN(00000000): There is no General DBReply Method Index details may not be specified
May 23 18:57:26.376: RADIUS/ENCODE(00000000):Orig. component type = Invalid
May 23 18:57:26.376: RADIUS(00000000): Config NAS IP: 192.168.178.254
May 23 18:57:26.376: RADIUS(00000000): Config NAS IPv6: ::
May 23 18:57:26.376: RADIUS(00000000): sending
May 23 18:57:26.376: RADIUS: Message Authenticator encoded
May 23 18:57:26.376: RADIUS(00000000): Send Access-Request to 192.168.178.72:1812 onvrf(0) id 1645/212, len 261
May 23 18:57:26.376: RADIUS:  authenticator F2 E3 F2 56 30 0A F1 82 - E3 74 95 E9 4E 1F EF 49
May 23 18:57:26.376: RADIUS:  User-Name           [1]   14  "e4115b2c0e3b"  
May 23 18:57:26.376: RADIUS:  User-Password       [2]   18  *
May 23 18:57:26.384: RADIUS:  Service-Type        [6]   6   Call Check                [10]
May 23 18:57:26.384: RADIUS:  Vendor, Cisco       [26]  31
May 23 18:57:26.384: RADIUS:   Cisco AVpair       [1]   25  "service-type=Call Check"  
May 23 18:57:26.384: RADIUS:  Framed-MTU          [12]  6   1500
May 23 18:57:26.384: RADIUS:  Called-Station-Id   [30]  19  "A4-4C-11-19-F8-0E"  
May 23 18:57:26.384: RADIUS:  Calling-Station-Id  [31]  19  "E4-11-5B-2C-0E-3B"  
May 23 18:57:26.384: RADIUS:  Message-Authenticato[80]  18
May 23 18:57:26.384: RADIUS:   56 BA 1B 76 50 25 20 14 9D 1D 24 29 7F DF 28 85          [ VvP? $)(]
May 23 18:57:26.384: RADIUS:  EAP-Key-Name        [102] 2   *
May 23 18:57:26.384: RADIUS:  Vendor, Cisco       [26]  49
May 23 18:57:26.384: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=C0A8B2FE0000003A0A0B8833"  
May 23 18:57:26.384: RADIUS:  Vendor, Cisco       [26]  18
May 23 18:57:26.384: RADIUS:   Cisco AVpair       [1]   12  "method=mab"  
May 23 18:57:26.384: RADIUS:  NAS-IP-Address      [4]   6   192.168.178.254
May 23 18:57:26.384: RADIUS:  NAS-Port-Id         [87]  23  "GigabitEthernet1/0/14"  
May 23 18:57:26.384: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
May 23 18:57:26.384: RADIUS:  NAS-Port            [5]   6   50114
May 23 18:57:26.384: RADIUS(00000000): Sending a IPv4 Radius Packet
May 23 18:57:26.384: RADIUS(00000000): Started 5 sec timeout
May 23 18:57:26.393: AAA/AUTHEN/8021X (00000000): Pick method list 'default'  
May 23 18:57:26.393: AAA/AUTHEN(00000000): There is no General DBReply Method Index details may not be specified
May 23 18:57:26.393: RADIUS/ENCODE(00000000):Orig. component type = Invalid
May 23 18:57:26.393: RADIUS(00000000): Config NAS IP: 192.168.178.254
May 23 18:57:26.393: RADIUS(00000000): Config NAS IPv6: ::
May 23 18:57:26.393: RADIUS(00000000): sending
May 23 18:57:26.393: RADIUS: Message Authenticator encoded
May 23 18:57:26.393: RADIUS(00000000): Send Access-Request to 192.168.178.72:1812 onvrf(0) id 1645/213, len 254
May 23 18:57:26.393: RADIUS:  authenticator BB BF 16 EF DA 06 AD 33 - F4 E8 84 0B 2D 13 8C 74
May 23 18:57:26.393: RADIUS:  User-Name           [1]   11  "christian"  
May 23 18:57:26.393: RADIUS:  Service-Type        [6]   6   Framed                    [2]
May 23 18:57:26.393: RADIUS:  Vendor, Cisco       [26]  27
May 23 18:57:26.393: RADIUS:   Cisco AVpair       [1]   21  "service-type=Framed"  
May 23 18:57:26.393: RADIUS:  Framed-MTU          [12]  6   1500
May 23 18:57:26.393: RADIUS:  Called-Station-Id   [30]  19  "A4-4C-11-19-F8-0E"  
May 23 18:57:26.401: RADIUS:  Calling-Station-Id  [31]  19  "E4-11-5B-2C-0E-3B"  
May 23 18:57:26.401: RADIUS:  EAP-Message         [79]  16
May 23 18:57:26.401: RADIUS:   02 01 00 0E 01 63 68 72 69 73 74 69 61 6E         [ christian]
May 23 18:57:26.401: RADIUS:  Message-Authenticato[80]  18
May 23 18:57:26.401: RADIUS:   BB 83 6B 2B FF BB 10 13 B8 09 E9 F4 03 6D 53 B6              [ k+mS]
May 23 18:57:26.401: RADIUS:  EAP-Key-Name        [102] 2   *
May 23 18:57:26.401: RADIUS:  Vendor, Cisco       [26]  49
May 23 18:57:26.401: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=C0A8B2FE0000003A0A0B8833"  
May 23 18:57:26.401: RADIUS:  Vendor, Cisco       [26]  20
May 23 18:57:26.401: RADIUS:   Cisco AVpair       [1]   14  "method=dot1x"  
May 23 18:57:26.401: RADIUS:  NAS-IP-Address      [4]   6   192.168.178.254
May 23 18:57:26.401: RADIUS:  NAS-Port-Id         [87]  23  "GigabitEthernet1/0/14"  
May 23 18:57:26.401: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
May 23 18:57:26.401: RADIUS:  NAS-Port            [5]   6   50114
May 23 18:57:26.401: RADIUS(00000000): Sending a IPv4 Radius Packet
May 23 18:57:26.401: RADIUS(00000000): Started 5 sec timeout
May 23 18:57:26.409: RADIUS: Received from id 1645/213 192.168.178.72:1812, Access-Challenge, len 80
May 23 18:57:26.409: RADIUS:  authenticator 57 F3 42 2B 84 B0 5C C4 - 24 54 16 AA A8 D7 1A D7
May 23 18:57:26.409: RADIUS:  EAP-Message         [79]  24
May 23 18:57:26.409: RADIUS:   01 02 00 16 04 10 BD 4D 93 6D D9 E3 CB ED AF 67 43 3A B1 19 1C B3             [ MmgC:]
May 23 18:57:26.409: RADIUS:  Message-Authenticato[80]  18
May 23 18:57:26.409: RADIUS:   38 19 56 5C D7 BF BA 66 CA 30 53 5A 0E 52 4C A0         [ 8V\f0SZRL]
May 23 18:57:26.409: RADIUS:  State               [24]  18
May 23 18:57:26.409: RADIUS:   74 D0 F8 E9 74 D2 FC E4 B5 5A 95 E6 EE 28 70 23            [ ttZ(p#]
May 23 18:57:26.409: RADIUS(00000000): Received from id 1645/213
May 23 18:57:26.409: RADIUS/DECODE: EAP-Message fragments, 22, total 22 bytes
May 23 18:57:26.418: AAA/AUTHEN/8021X (00000000): Pick method list 'default'  
May 23 18:57:26.418: AAA/AUTHEN(00000000): There is no General DBReply Method Index details may not be specified
May 23 18:57:26.418: RADIUS/ENCODE(00000000):Orig. component type = Invalid
May 23 18:57:26.418: RADIUS(00000000): Config NAS IP: 192.168.178.254
May 23 18:57:26.418: RADIUS(00000000): Config NAS IPv6: ::
May 23 18:57:26.418: RADIUS(00000000): sending
May 23 18:57:26.418: RADIUS: Message Authenticator encoded
May 23 18:57:26.418: RADIUS(00000000): Send Access-Request to 192.168.178.72:1812 onvrf(0) id 1645/214, len 264
May 23 18:57:26.418: RADIUS:  authenticator D6 2C 69 81 E1 15 AC 45 - B1 9D F3 21 84 E2 7E 22
May 23 18:57:26.418: RADIUS:  User-Name           [1]   11  "christian"  
May 23 18:57:26.418: RADIUS:  Service-Type        [6]   6   Framed                    [2]
May 23 18:57:26.418: RADIUS:  Vendor, Cisco       [26]  27
May 23 18:57:26.418: RADIUS:   Cisco AVpair       [1]   21  "service-type=Framed"  
May 23 18:57:26.418: RADIUS:  Framed-MTU          [12]  6   1500
May 23 18:57:26.418: RADIUS:  Called-Station-Id   [30]  19  "A4-4C-11-19-F8-0E"  
May 23 18:57:26.418: RADIUS:  Calling-Station-Id  [31]  19  "E4-11-5B-2C-0E-3B"  
May 23 18:57:26.418: RADIUS:  EAP-Message         [79]  8
May 23 18:57:26.418: RADIUS:   02 02 00 06 03 19
May 23 18:57:26.418: RADIUS:  Message-Authenticato[80]  18
May 23 18:57:26.418: RADIUS:   F9 4F 3F 79 E2 04 A1 10 7C 4A 15 E4 EC 4F 6C 4B          [ O?y|JOlK]
May 23 18:57:26.418: RADIUS:  EAP-Key-Name        [102] 2   *
May 23 18:57:26.418: RADIUS:  Vendor, Cisco       [26]  49
May 23 18:57:26.418: RADIUS:   Cisco AVpair       [1]   43  "audit-session-id=C0A8B2FE0000003A0A0B8833"  
May 23 18:57:26.418: RADIUS:  Vendor, Cisco       [26]  20
May 23 18:57:26.418: RADIUS:   Cisco AVpair       [1]   14  "method=dot1x"  
May 23 18:57:26.426: RADIUS:  NAS-IP-Address      [4]   6   192.168.178.254
May 23 18:57:26.426: RADIUS:  NAS-Port-Id         [87]  23  "GigabitEthernet1/0/14"  
May 23 18:57:26.426: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]
May 23 18:57:26.426: RADIUS:  NAS-Port            [5]   6   50114
May 23 18:57:26.426: RADIUS:  State               [24]  18
May 23 18:57:26.426: RADIUS:   74 D0 F8 E9 74 D2 FC E4 B5 5A 95 E6 EE 28 70 23            [ ttZ(p#]
May 23 18:57:26.426: RADIUS(00000000): Sending a IPv4 Radius Packet
May 23 18:57:26.426: RADIUS(00000000): Started 5 sec timeout
May 23 18:57:27.399: RADIUS: Received from id 1645/212 192.168.178.72:1812, Access-Reject, len 20
May 23 18:57:27.399: RADIUS:  authenticator 1A 7C AC 90 5F 38 51 73 - D8 C9 ED 14 BE CF 3E E9
May 23 18:57:27.399: RADIUS(00000000): Received from id 1645/212
May 23 18:57:27.399: %MAB-5-FAIL: Authentication failed for client (e411.5b2c.0e3b) on Interface Gi1/0/14 AuditSessionID C0A8B2FE0000003A0A0B8833
May 23 18:57:27.433: RADIUS: Received from id 1645/214 192.168.178.72:1812, Access-Reject, len 44
May 23 18:57:27.433: RADIUS:  authenticator D8 7B 18 A2 1C 30 4A F7 - F4 18 3B 9A 43 A6 DB 10
May 23 18:57:27.433: RADIUS:  EAP-Message         [79]  6
May 23 18:57:27.433: RADIUS:   04 02 00 04
May 23 18:57:27.433: RADIUS:  Message-Authenticato[80]  18
May 23 18:57:27.433: RADIUS:   20 C0 16 D8 BD 60 BE 16 A9 B9 45 9C 9A E5 72 C0              [  `Er]
May 23 18:57:27.433: RADIUS(00000000): Received from id 1645/214
May 23 18:57:27.433: RADIUS/DECODE: EAP-Message fragments, 4, total 4 bytes
May 23 18:57:27.433: %DOT1X-5-FAIL: Authentication failed for client (e411.5b2c.0e3b) on Interface Gi1/0/14 AuditSessionID C0A8B2FE0000003A0A0B8833
May 23 18:57:28.322: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/14, changed state to up
May 23 18:57:29.328: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/14, changed state to up
Switch#

Ready to process requests
(0) Received Access-Request Id 212 from 192.168.178.254:1645 to 192.168.178.72:1812 length 261
(0)   User-Name = "e4115b2c0e3b"  
(0)   User-Password = "e4115b2c0e3b"  
(0)   Service-Type = Call-Check
(0)   Cisco-AVPair = "service-type=Call Check"  
(0)   Framed-MTU = 1500
(0)   Called-Station-Id = "A4-4C-11-19-F8-0E"  
(0)   Calling-Station-Id = "E4-11-5B-2C-0E-3B"  
(0)   Message-Authenticator = 0x56ba1b76502520149d1d24297fdf2885
(0)   Cisco-AVPair = "audit-session-id=C0A8B2FE0000003A0A0B8833"  
(0)   Cisco-AVPair = "method=mab"  
(0)   NAS-IP-Address = 192.168.178.254
(0)   NAS-Port-Id = "GigabitEthernet1/0/14"  
(0)   NAS-Port-Type = Ethernet
(0)   NAS-Port = 50114
(0) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(0)   authorize {
(0)     policy filter_username {
(0)       if (&User-Name) {
(0)       if (&User-Name)  -> TRUE
(0)       if (&User-Name)  {
(0)         if (&User-Name =~ / /) {
(0)         if (&User-Name =~ / /)  -> FALSE
(0)         if (&User-Name =~ /@[^@]*@/ ) {
(0)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(0)         if (&User-Name =~ /\.\./ ) {
(0)         if (&User-Name =~ /\.\./ )  -> FALSE
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(0)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(0)         if (&User-Name =~ /\.$/)  {
(0)         if (&User-Name =~ /\.$/)   -> FALSE
(0)         if (&User-Name =~ /@\./)  {
(0)         if (&User-Name =~ /@\./)   -> FALSE
(0)       } # if (&User-Name)  = notfound
(0)     } # policy filter_username = notfound
(0)     [preprocess] = ok
(0)     [chap] = noop
(0)     [mschap] = noop
(0)     [digest] = noop
(0) suffix: Checking for suffix after "@"  
(0) suffix: No '@' in User-Name = "e4115b2c0e3b", looking up realm NULL  
(0) suffix: No such realm "NULL"  
(0)     [suffix] = noop
(0) eap: No EAP-Message, not doing EAP
(0)     [eap] = noop
(0)     [files] = noop
(0) sql: EXPAND %{User-Name}
(0) sql:    --> e4115b2c0e3b
(0) sql: SQL-User-Name set to 'e4115b2c0e3b'  
rlm_sql (sql): Reserved connection (1)
(0) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id  
(0) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'e4115b2c0e3b' ORDER BY id  
(0) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'e4115b2c0e3b' ORDER BY id  
(0) sql: WARNING: User not found in radcheck table.
(0) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority  
(0) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'e4115b2c0e3b' ORDER BY priority  
(0) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'e4115b2c0e3b' ORDER BY priority  
(0) sql: User not found in any groups
rlm_sql (sql): Released connection (1)
Need more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (6), 1 of 26 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 5.5.5-10.6.12-MariaDB-0ubuntu0.22.04.1, protocol version 10  
(0)     [sql] = notfound
(0)     [expiration] = noop
(0)     [logintime] = noop
(0) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
(0) pap: WARNING: Authentication will fail unless a "known good" password is available  
(0)     [pap] = noop
(0)   } # authorize = ok
(0) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(0) Failed to authenticate the user
(0) Using Post-Auth-Type Reject
(0) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(0)   Post-Auth-Type REJECT {
(0) sql: EXPAND .query
(0) sql:    --> .query
(0) sql: Using query template 'query'  
rlm_sql (sql): Reserved connection (2)
(0) sql: EXPAND %{User-Name}
(0) sql:    --> e4115b2c0e3b
(0) sql: SQL-User-Name set to 'e4115b2c0e3b'  
(0) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )  
(0) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'e4115b2c0e3b', 'e4115b2c0e3b', 'Access-Reject', '2023-05-23 18:57:26.395295' )  
(0) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'e4115b2c0e3b', 'e4115b2c0e3b', 'Access-Reject', '2023-05-23 18:57:26.395295' )  
(0) sql: SQL query returned: success
(0) sql: 1 record(s) updated
rlm_sql (sql): Released connection (2)
(0)     [sql] = ok
(0) attr_filter.access_reject: EXPAND %{User-Name}
(0) attr_filter.access_reject:    --> e4115b2c0e3b
(0) attr_filter.access_reject: Matched entry DEFAULT at line 11
(0)     [attr_filter.access_reject] = updated
(0)     [eap] = noop
(0)     policy remove_reply_message_if_eap {
(0)       if (&reply:EAP-Message && &reply:Reply-Message) {
(0)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(0)       else {
(0)         [noop] = noop
(0)       } # else = noop
(0)     } # policy remove_reply_message_if_eap = noop
(0)   } # Post-Auth-Type REJECT = updated
(0) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
(1) Received Access-Request Id 213 from 192.168.178.254:1645 to 192.168.178.72:1812 length 254
(1)   User-Name = "christian"  
(1)   Service-Type = Framed-User
(1)   Cisco-AVPair = "service-type=Framed"  
(1)   Framed-MTU = 1500
(1)   Called-Station-Id = "A4-4C-11-19-F8-0E"  
(1)   Calling-Station-Id = "E4-11-5B-2C-0E-3B"  
(1)   EAP-Message = 0x0201000e0163687269737469616e
(1)   Message-Authenticator = 0xbb836b2bffbb1013b809e9f4036d53b6
(1)   Cisco-AVPair = "audit-session-id=C0A8B2FE0000003A0A0B8833"  
(1)   Cisco-AVPair = "method=dot1x"  
(1)   NAS-IP-Address = 192.168.178.254
(1)   NAS-Port-Id = "GigabitEthernet1/0/14"  
(1)   NAS-Port-Type = Ethernet
(1)   NAS-Port = 50114
(1) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(1)   authorize {
(1)     policy filter_username {
(1)       if (&User-Name) {
(1)       if (&User-Name)  -> TRUE
(1)       if (&User-Name)  {
(1)         if (&User-Name =~ / /) {
(1)         if (&User-Name =~ / /)  -> FALSE
(1)         if (&User-Name =~ /@[^@]*@/ ) {
(1)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(1)         if (&User-Name =~ /\.\./ ) {
(1)         if (&User-Name =~ /\.\./ )  -> FALSE
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(1)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(1)         if (&User-Name =~ /\.$/)  {
(1)         if (&User-Name =~ /\.$/)   -> FALSE
(1)         if (&User-Name =~ /@\./)  {
(1)         if (&User-Name =~ /@\./)   -> FALSE
(1)       } # if (&User-Name)  = notfound
(1)     } # policy filter_username = notfound
(1)     [preprocess] = ok
(1)     [chap] = noop
(1)     [mschap] = noop
(1)     [digest] = noop
(1) suffix: Checking for suffix after "@"  
(1) suffix: No '@' in User-Name = "christian", looking up realm NULL  
(1) suffix: No such realm "NULL"  
(1)     [suffix] = noop
(1) eap: Peer sent EAP Response (code 2) ID 1 length 14
(1) eap: EAP-Identity reply, returning 'ok' so we can short-circuit the rest of authorize  
(1)     [eap] = ok
(1)   } # authorize = ok
(1) Found Auth-Type = eap
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   authenticate {
(1) eap: Peer sent packet with method EAP Identity (1)
(1) eap: Calling submodule eap_md5 to process data
(1) eap_md5: Issuing MD5 Challenge
(1) eap: Sending EAP Request (code 1) ID 2 length 22
(1) eap: EAP session adding &reply:State = 0x74d0f8e974d2fce4
(1)     [eap] = handled
(1)   } # authenticate = handled
(1) Using Post-Auth-Type Challenge
(1) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(1)   Challenge { ... } # empty sub-section is ignored
(1) Sent Access-Challenge Id 213 from 192.168.178.72:1812 to 192.168.178.254:1645 length 80
(1)   EAP-Message = 0x010200160410bd4d936dd9e3cbedaf67433ab1191cb3
(1)   Message-Authenticator = 0x00000000000000000000000000000000
(1)   State = 0x74d0f8e974d2fce4b55a95e6ee287023
(1) Finished request
Waking up in 0.3 seconds.
(2) Received Access-Request Id 214 from 192.168.178.254:1645 to 192.168.178.72:1812 length 264
(2)   User-Name = "christian"  
(2)   Service-Type = Framed-User
(2)   Cisco-AVPair = "service-type=Framed"  
(2)   Framed-MTU = 1500
(2)   Called-Station-Id = "A4-4C-11-19-F8-0E"  
(2)   Calling-Station-Id = "E4-11-5B-2C-0E-3B"  
(2)   EAP-Message = 0x020200060319
(2)   Message-Authenticator = 0xf94f3f79e204a1107c4a15e4ec4f6c4b
(2)   Cisco-AVPair = "audit-session-id=C0A8B2FE0000003A0A0B8833"  
(2)   Cisco-AVPair = "method=dot1x"  
(2)   NAS-IP-Address = 192.168.178.254
(2)   NAS-Port-Id = "GigabitEthernet1/0/14"  
(2)   NAS-Port-Type = Ethernet
(2)   NAS-Port = 50114
(2)   State = 0x74d0f8e974d2fce4b55a95e6ee287023
(2) session-state: No cached attributes
(2) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(2)   authorize {
(2)     policy filter_username {
(2)       if (&User-Name) {
(2)       if (&User-Name)  -> TRUE
(2)       if (&User-Name)  {
(2)         if (&User-Name =~ / /) {
(2)         if (&User-Name =~ / /)  -> FALSE
(2)         if (&User-Name =~ /@[^@]*@/ ) {
(2)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(2)         if (&User-Name =~ /\.\./ ) {
(2)         if (&User-Name =~ /\.\./ )  -> FALSE
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(2)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(2)         if (&User-Name =~ /\.$/)  {
(2)         if (&User-Name =~ /\.$/)   -> FALSE
(2)         if (&User-Name =~ /@\./)  {
(2)         if (&User-Name =~ /@\./)   -> FALSE
(2)       } # if (&User-Name)  = notfound
(2)     } # policy filter_username = notfound
(2)     [preprocess] = ok
(2)     [chap] = noop
(2)     [mschap] = noop
(2)     [digest] = noop
(2) suffix: Checking for suffix after "@"  
(2) suffix: No '@' in User-Name = "christian", looking up realm NULL  
(2) suffix: No such realm "NULL"  
(2)     [suffix] = noop
(2) eap: Peer sent EAP Response (code 2) ID 2 length 6
(2) eap: No EAP Start, assuming it's an on-going EAP conversation  
(2)     [eap] = updated
(2)     [files] = noop
(2) sql: EXPAND %{User-Name}
(2) sql:    --> christian
(2) sql: SQL-User-Name set to 'christian'  
rlm_sql (sql): Reserved connection (3)
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id  
(2) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'christian' ORDER BY id  
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'christian' ORDER BY id  
(2) sql: User found in radcheck table
(2) sql: Conditional check items matched, merging assignment check items
(2) sql:   MD5-Password := 0x4446354445444543334532333939453142373933323837314143413537383939
(2) sql: EXPAND SELECT id, username, attribute, value, op FROM radreply WHERE username = '%{SQL-User-Name}' ORDER BY id  
(2) sql:    --> SELECT id, username, attribute, value, op FROM radreply WHERE username = 'christian' ORDER BY id  
(2) sql: Executing select query: SELECT id, username, attribute, value, op FROM radreply WHERE username = 'christian' ORDER BY id  
(2) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority  
(2) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'christian' ORDER BY priority  
(2) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'christian' ORDER BY priority  
(2) sql: User found in the group table
(2) sql: EXPAND SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = '%{SQL-Group}' ORDER BY id  
(2) sql:    --> SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'daloRADIUS-Disabled-Users' ORDER BY id  
(2) sql: Executing select query: SELECT id, groupname, attribute, Value, op FROM radgroupcheck WHERE groupname = 'daloRADIUS-Disabled-Users' ORDER BY id  
(2) sql: Group "daloRADIUS-Disabled-Users": Conditional check items matched  
(2) sql: Group "daloRADIUS-Disabled-Users": Merging assignment check items  
(2) sql:   Auth-Type := Reject
(2) sql: EXPAND SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = '%{SQL-Group}' ORDER BY id  
(2) sql:    --> SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'daloRADIUS-Disabled-Users' ORDER BY id  
(2) sql: Executing select query: SELECT id, groupname, attribute, value, op FROM radgroupreply WHERE groupname = 'daloRADIUS-Disabled-Users' ORDER BY id  
(2) sql: Group "daloRADIUS-Disabled-Users": Merging reply items  
rlm_sql (sql): Released connection (3)
(2)     [sql] = ok
(2)     [expiration] = noop
(2)     [logintime] = noop
(2) pap: Normalizing MD5-Password from hex encoding, 32 bytes -> 16 bytes
(2) pap: WARNING: Auth-Type already set.  Not setting to PAP
(2)     [pap] = noop
(2)   } # authorize = updated
(2) Found Auth-Type = Reject
(2) Auth-Type = Reject, rejecting user
(2) Failed to authenticate the user
(2) Using Post-Auth-Type Reject
(2) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(2)   Post-Auth-Type REJECT {
(2) sql: EXPAND .query
(2) sql:    --> .query
(2) sql: Using query template 'query'  
rlm_sql (sql): Reserved connection (4)
(2) sql: EXPAND %{User-Name}
(2) sql:    --> christian
(2) sql: SQL-User-Name set to 'christian'  
(2) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )  
(2) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'christian', '', 'Access-Reject', '2023-05-23 18:57:26.434381' )  
(2) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'christian', '', 'Access-Reject', '2023-05-23 18:57:26.434381' )  
(2) sql: SQL query returned: success
(2) sql: 1 record(s) updated
rlm_sql (sql): Released connection (4)
(2)     [sql] = ok
(2) attr_filter.access_reject: EXPAND %{User-Name}
(2) attr_filter.access_reject:    --> christian
(2) attr_filter.access_reject: Matched entry DEFAULT at line 11
(2)     [attr_filter.access_reject] = updated
(2) eap: Expiring EAP session with state 0x74d0f8e974d2fce4
(2) eap: Finished EAP session with state 0x74d0f8e974d2fce4
(2) eap: Previous EAP request found for state 0x74d0f8e974d2fce4, released from the list
(2) eap: Request was previously rejected, inserting EAP-Failure
(2) eap: Sending EAP Failure (code 4) ID 2 length 4
(2)     [eap] = updated
(2)     policy remove_reply_message_if_eap {
(2)       if (&reply:EAP-Message && &reply:Reply-Message) {
(2)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(2)       else {
(2)         [noop] = noop
(2)       } # else = noop
(2)     } # policy remove_reply_message_if_eap = noop
(2)   } # Post-Auth-Type REJECT = updated
(2) Delaying response for 1.000000 seconds
Waking up in 0.2 seconds.
Waking up in 0.6 seconds.
(0) Sending delayed response
(0) Sent Access-Reject Id 212 from 192.168.178.72:1812 to 192.168.178.254:1645 length 20
(2) Sending delayed response
(2) Sent Access-Reject Id 214 from 192.168.178.72:1812 to 192.168.178.254:1645 length 44
(2)   EAP-Message = 0x04020004
(2)   Message-Authenticator = 0x00000000000000000000000000000000
Waking up in 3.9 seconds.
(0) Cleaning up request packet ID 212 with timestamp +14 due to cleanup_delay was reached
(1) Cleaning up request packet ID 213 with timestamp +14 due to cleanup_delay was reached
(2) Cleaning up request packet ID 214 with timestamp +14 due to cleanup_delay was reached
Ready to process requests
(3) Received Access-Request Id 215 from 192.168.178.254:1645 to 192.168.178.72:1812 length 261
(3)   User-Name = "e4115b2c0e3b"  
(3)   User-Password = "e4115b2c0e3b"  
(3)   Service-Type = Call-Check
(3)   Cisco-AVPair = "service-type=Call Check"  
(3)   Framed-MTU = 1500
(3)   Called-Station-Id = "A4-4C-11-19-F8-0E"  
(3)   Calling-Station-Id = "E4-11-5B-2C-0E-3B"  
(3)   Message-Authenticator = 0x362ea4d10eb96541f3292c00d10d9c6e
(3)   Cisco-AVPair = "audit-session-id=C0A8B2FE0000003A0A0B8833"  
(3)   Cisco-AVPair = "method=mab"  
(3)   NAS-IP-Address = 192.168.178.254
(3)   NAS-Port-Id = "GigabitEthernet1/0/14"  
(3)   NAS-Port-Type = Ethernet
(3)   NAS-Port = 50114
(3) # Executing section authorize from file /etc/freeradius/3.0/sites-enabled/default
(3)   authorize {
(3)     policy filter_username {
(3)       if (&User-Name) {
(3)       if (&User-Name)  -> TRUE
(3)       if (&User-Name)  {
(3)         if (&User-Name =~ / /) {
(3)         if (&User-Name =~ / /)  -> FALSE
(3)         if (&User-Name =~ /@[^@]*@/ ) {
(3)         if (&User-Name =~ /@[^@]*@/ )  -> FALSE
(3)         if (&User-Name =~ /\.\./ ) {
(3)         if (&User-Name =~ /\.\./ )  -> FALSE
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))  {
(3)         if ((&User-Name =~ /@/) && (&User-Name !~ /@(.+)\.(.+)$/))   -> FALSE
(3)         if (&User-Name =~ /\.$/)  {
(3)         if (&User-Name =~ /\.$/)   -> FALSE
(3)         if (&User-Name =~ /@\./)  {
(3)         if (&User-Name =~ /@\./)   -> FALSE
(3)       } # if (&User-Name)  = notfound
(3)     } # policy filter_username = notfound
(3)     [preprocess] = ok
(3)     [chap] = noop
(3)     [mschap] = noop
(3)     [digest] = noop
(3) suffix: Checking for suffix after "@"  
(3) suffix: No '@' in User-Name = "e4115b2c0e3b", looking up realm NULL  
(3) suffix: No such realm "NULL"  
(3)     [suffix] = noop
(3) eap: No EAP-Message, not doing EAP
(3)     [eap] = noop
(3)     [files] = noop
(3) sql: EXPAND %{User-Name}
(3) sql:    --> e4115b2c0e3b
(3) sql: SQL-User-Name set to 'e4115b2c0e3b'  
rlm_sql (sql): Reserved connection (0)
(3) sql: EXPAND SELECT id, username, attribute, value, op FROM radcheck WHERE username = '%{SQL-User-Name}' ORDER BY id  
(3) sql:    --> SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'e4115b2c0e3b' ORDER BY id  
(3) sql: Executing select query: SELECT id, username, attribute, value, op FROM radcheck WHERE username = 'e4115b2c0e3b' ORDER BY id  
(3) sql: WARNING: User not found in radcheck table.
(3) sql: EXPAND SELECT groupname FROM radusergroup WHERE username = '%{SQL-User-Name}' ORDER BY priority  
(3) sql:    --> SELECT groupname FROM radusergroup WHERE username = 'e4115b2c0e3b' ORDER BY priority  
(3) sql: Executing select query: SELECT groupname FROM radusergroup WHERE username = 'e4115b2c0e3b' ORDER BY priority  
(3) sql: User not found in any groups
rlm_sql (sql): Released connection (0)
Need more connections to reach 10 spares
rlm_sql (sql): Opening additional connection (7), 1 of 25 pending slots used
rlm_sql_mysql: Starting connect to MySQL server
rlm_sql_mysql: Connected to database 'radiusdb' on Localhost via UNIX socket, server version 5.5.5-10.6.12-MariaDB-0ubuntu0.22.04.1, protocol version 10  
rlm_sql (sql): Closing expired connection (6) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (5) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (4) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (3) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): Closing expired connection (2) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
rlm_sql (sql): You probably need to lower "min"  
rlm_sql (sql): Closing expired connection (1) - Hit idle_timeout limit
rlm_sql_mysql: Socket destructor called, closing socket
(3)     [sql] = notfound
(3)     [expiration] = noop
(3)     [logintime] = noop
(3) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
(3) pap: WARNING: Authentication will fail unless a "known good" password is available  
(3)     [pap] = noop
(3)   } # authorize = ok
(3) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(3) Failed to authenticate the user
(3) Using Post-Auth-Type Reject
(3) # Executing group from file /etc/freeradius/3.0/sites-enabled/default
(3)   Post-Auth-Type REJECT {
(3) sql: EXPAND .query
(3) sql:    --> .query
(3) sql: Using query template 'query'  
rlm_sql (sql): Reserved connection (0)
(3) sql: EXPAND %{User-Name}
(3) sql:    --> e4115b2c0e3b
(3) sql: SQL-User-Name set to 'e4115b2c0e3b'  
(3) sql: EXPAND INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( '%{SQL-User-Name}', '%{%{User-Password}:-%{Chap-Password}}', '%{reply:Packet-Type}', '%S.%M' )  
(3) sql:    --> INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'e4115b2c0e3b', 'e4115b2c0e3b', 'Access-Reject', '2023-05-23 18:58:28.182081' )  
(3) sql: Executing query: INSERT INTO radpostauth (username, pass, reply, authdate ) VALUES ( 'e4115b2c0e3b', 'e4115b2c0e3b', 'Access-Reject', '2023-05-23 18:58:28.182081' )  
(3) sql: SQL query returned: success
(3) sql: 1 record(s) updated
rlm_sql (sql): Released connection (0)
(3)     [sql] = ok
(3) attr_filter.access_reject: EXPAND %{User-Name}
(3) attr_filter.access_reject:    --> e4115b2c0e3b
(3) attr_filter.access_reject: Matched entry DEFAULT at line 11
(3)     [attr_filter.access_reject] = updated
(3)     [eap] = noop
(3)     policy remove_reply_message_if_eap {
(3)       if (&reply:EAP-Message && &reply:Reply-Message) {
(3)       if (&reply:EAP-Message && &reply:Reply-Message)  -> FALSE
(3)       else {
(3)         [noop] = noop
(3)       } # else = noop
(3)     } # policy remove_reply_message_if_eap = noop
(3)   } # Post-Auth-Type REJECT = updated
(3) Delaying response for 1.000000 seconds
Waking up in 0.3 seconds.
Waking up in 0.6 seconds.
(3) Sending delayed response
(3) Sent Access-Reject Id 215 from 192.168.178.72:1812 to 192.168.178.254:1645 length 20
Waking up in 3.9 seconds.
(3) Cleaning up request packet ID 215 with timestamp +76 due to cleanup_delay was reached
Ready to process requests

May 23 18:57:26.376: RADIUS:  User-Name           [1]   14  "e4115b2c0e3b"  

(5) pap: WARNING: No "known good" password found for the user.  Not setting Auth-Type  
(5) pap: WARNING: Authentication will fail unless a "known good" password is available  
(5)     [pap] = noop
(5)   } # authorize = ok
(5) ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
(5) Failed to authenticate the user
(5) Using Post-Auth-Type Reject

May 23 18:57:26.384: RADIUS:   Cisco AVpair       [1]   12  "method=mab"  

interface GigabitEthernet1/0/14
 switchport mode access
 authentication order mab dot1x
 authentication port-control auto
 mab
 dot1x pae authenticator
 spanning-tree portfast edge

authentication order dot1x mab ---> this means that the switch will try dot1x first and if the device is not capable or does not respond, it will fall back to mab.
authentication priority mab dot1x ---> this means that mab will be preferred over dot1x. for example, if the dot1x capable machine did not respond to the initial attempt of the switch to perform dot1x, then it would fall back to mab. Now in this state, if the dot1x capable machine tries to perform dot1x, then switch will not perform dot1x authentication instead it will stick to the mab session. 

authentication event fail action next-method ---> this means that if dot1x authentication fails for a capable device, switch will perform mab as a fallback method.

(2) sql: EXPAND %{User-Name}
(2) sql:    --> christian
(2) sql: SQL-User-Name set to 'christian' 
rlm_sql (sql): Reserved connection (3)

interface GigabitEthernet1/0/14
 description Authentication Mac only (PAP)
 switchport mode access
 authentication port-control auto
 authentication periodic
 mab
 spanning-tree portfast

interface GigabitEthernet1/0/14
 description Authentication dot1x only
 switchport mode access
 authentication event fail action authorize vlan 10
 authentication port-control auto
 authentication periodic
 dot1x pae authenticator
 spanning-tree portfast

interface GigabitEthernet0/4
 description Authentication map plus dot1x
 switchport mode access
 authentication event fail action authorize vlan 10
 authentication order mab dot1x
 authentication port-control auto
 authentication periodic
 mab
 dot1x pae authenticator
 spanning-tree portfast

Wed May 24 19:19:18 2023 : Auth: (99) Login OK: [chris] (from client private-network-1 port 50114 cli E4-11-5B-2C-0E-3B)
Wed May 24 19:19:18 2023 : Debug: (99) Sent Access-Accept Id 55 from 192.168.178.72:1812 to 192.168.178.254:1645 length 51
Wed May 24 19:19:18 2023 : Debug: (99)   EAP-Message = 0x03020004
Wed May 24 19:19:18 2023 : Debug: (99)   Message-Authenticator = 0x00000000000000000000000000000000
Wed May 24 19:19:18 2023 : Debug: (99)   User-Name = "chris"  
Wed May 24 19:19:18 2023 : Debug: (99) Finished request
Wed May 24 19:19:18 2023 : Debug: Waking up in 4.9 seconds.
Wed May 24 19:19:23 2023 : Debug: (97) Cleaning up request packet ID 53 with timestamp +2890 due to cleanup_delay was reached
Wed May 24 19:19:23 2023 : Debug: (98) Cleaning up request packet ID 54 with timestamp +2890 due to cleanup_delay was reached
Wed May 24 19:19:23 2023 : Debug: (99) Cleaning up request packet ID 55 with timestamp +2890 due to cleanup_delay was reached
Wed May 24 19:19:23 2023 : Info: Ready to process requests

Wed May 24 19:35:19 2023 : Auth: (2) Login OK: [chris] (from client private-network-1 port 50114 cli E4-11-5B-2C-0E-3B)
Wed May 24 19:35:19 2023 : Debug: (2) Sent Access-Accept Id 74 from 192.168.178.72:1812 to 192.168.178.254:1645 length 51
Wed May 24 19:35:19 2023 : Debug: (2)   EAP-Message = 0x03020004
Wed May 24 19:35:19 2023 : Debug: (2)   Message-Authenticator = 0x00000000000000000000000000000000
Wed May 24 19:35:19 2023 : Debug: (2)   User-Name = "chris"  
Wed May 24 19:35:19 2023 : Debug: (2) Finished request
Wed May 24 19:35:19 2023 : Debug: Waking up in 0.2 seconds.
Wed May 24 19:35:20 2023 : Debug: Waking up in 0.6 seconds.
Wed May 24 19:35:20 2023 : Debug: (0) Sending delayed response
Wed May 24 19:35:20 2023 : Debug: (0) Sent Access-Reject Id 72 from 192.168.178.72:1812 to 192.168.178.254:1645 length 20
Wed May 24 19:35:20 2023 : Debug: Waking up in 3.9 seconds.
Wed May 24 19:35:24 2023 : Debug: (0) Cleaning up request packet ID 72 with timestamp +27 due to cleanup_delay was reached
Wed May 24 19:35:24 2023 : Debug: (1) Cleaning up request packet ID 73 with timestamp +27 due to cleanup_delay was reached
Wed May 24 19:35:24 2023 : Debug: (2) Cleaning up request packet ID 74 with timestamp +27 due to cleanup_delay was reached
Wed May 24 19:35:24 2023 : Info: Ready to process requests

 authentication order mab dot1x
 

 authentication event fail action authorize vlan 10 

 authentication event fail action authorize vlan 666 

 authentication event fail action authorize vlan 10 

 sh vlan