802.1X Wired Supplicant Authentication
Learn how to configure a switch interface as an IEEE 802.1X wired supplicant so that it authenticates to an upstream authenticator through a RADIUS server using EAP-MD5 or EAP-TLS. This topic also describes how to generate and load EAP-TLS certificates, verify supplicant status, and use syslog messages to isolate credential, PKI, and RADIUS issues.
You can configure select switch interfaces to operate as an IEEE 802.1X wired supplicant so that the connected device is authenticated before it is permitted to send traffic. In effect, a downstream switch establishes its identity and authenticates itself to an upstream switch, ensuring secure communication between the two devices. This also allows devices that do not support 802.1X to connect behind an authenticated upstream port.
You configure supplicant settings on a per-interface basis. You can apply this configuration to Layer 2 access interfaces, Layer 2 trunk interfaces, Layer 3 interfaces, and link aggregation group (LAG) interfaces. Only one supplicant can be configured per interface, and only one supplicant instance can be configured per LAG interface.
Benefits of 802.1X Wired Supplicant on Switch Interfaces
-
Secures upstream connectivity - Authenticates an uplink to an upstream 802.1X and RADIUS domain before the network treats the link as authorized.
-
Extends authentication to non-802.1X devices - Allows devices that do not support 802.1X to connect behind an authenticated upstream port.
-
Supports flexible EAP methods - Supports EAP-MD5 and EAP-TLS to align with site security requirements.
-
Simplifies failure isolation - Helps isolate authentication failures by logging held-state failure reasons.
-
Improves troubleshooting - Improves troubleshooting by logging disconnect and logoff events to help differentiate user-initiated logoff from network-driven or policy-driven session drops.
Configuration and troubleshooting notes
For LAG interfaces, choose where the supplicant runs because the feature enforces parent and child exclusivity. Configure the supplicant on either the LAG parent interface or on a child interface, but not both. You can configure only one supplicant instance per LAG interface.
Supported EAP Methods
Select one EAP method per interface:
| EAP Method | Description | Required Configuration |
|---|---|---|
| EAP-MD5 | EAP-MD5-Challenge (RFC 2284) authenticates a connection request by verifying an MD5 hash of the user's password. The server sends a random challenge, and the client proves its identity by hashing the challenge and its password with MD5. | user-id and password |
| EAP-TLS | EAP-TLS (RFC 2716) uses PKI digital certificates to provide mutual authentication between the supplicant and the authentication server. A TLS tunnel is established during certificate exchange, making this the more secure of the two methods. Note that the user identity is still sent in cleartext before certificate exchange begins. | user-id and local-certificate |
Supplicant Support on LAG Interfaces
When an EAP message is trapped on a child (member) interface of an aggregated Ethernet (AE)
interface, dot1x inspects the parent interface using the child interface's
ifd_agg_parentidx flag, so EAP packets are processed on the parent
interface rather than the child interface.
- Enable the supplicant on the child interface when supplicant-configured interfaces connect to multiple switches in a multi-homed scenario.
- Enable the supplicant on the parent interface in a single-homed scenario.
- At any given time, the supplicant can be enabled on either the child or the parent of a LAG, but not both, and only one supplicant instance is permitted per LAG interface.
- Supplicant can be enabled on an interface range.
- Configuring supplicant and authenticator on the same interface is not prohibited by a commit check, but it is not a supported requirement.
- EAP-PEAP is not a supported authentication method.
- Supplicant is not supported on IRB interfaces or on SP-style interfaces.
- Supplicant cannot be enabled on the interface
all.
Configuring EAP-MD5
set protocols dot1x supplicant interface ge-0/0/0.0 authentication-method eap-md5 set protocols dot1x supplicant interface ge-0/0/0.0 user-id xyz set protocols dot1x supplicant interface ge-0/0/0.0 password "password"
Configuring EAP-TLS
set protocols dot1x supplicant interface ge-0/0/0.0 authentication-method eap-md5 set protocols dot1x supplicant interface ge-0/0/0.0 user-id xyz set protocols dot1x supplicant interface ge-0/0/0.0 password "password"
Configuring the Supplicant on a LAG interface
set protocols dot1x supplicant interface ae0.0 authentication-method eap-tls set protocols dot1x supplicant interface ae0.0 user-id xyz set protocols dot1x supplicant interface ae0.0 local-certificate switch_cert
Configuring the Supplicant on an Interface Range
set interfaces interface-range range1 member-range ge-0/0/18 to ge-0/0/20 set protocols dot1x supplicant interface range1 authentication-method eap-tls set protocols dot1x supplicant interface range1 local-certificate switch_cert
Generating and Loading a Certificate for EAP-TLS
EAP-TLS requires a local certificate to be provisioned on the device and referenced in the PKI configuration. To generate a certificate chain and client certificate using OpenSSL:
### Generate CA certificate ### openssl genrsa -des3 -out ca.key 2048 openssl req -new -x509 -days 365 -key ca.key -out ca.crt ### Server certificate signed by CA ### openssl genrsa -des3 -out server.key 2048 openssl req -new -key server.key -out server.csr openssl x509 -req -days 365 -in server.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out server.crt openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12 openssl pkcs12 -clcerts -in server.p12 -out server.pem ### Client certificate signed by same CA ### openssl genrsa -des3 -out client.key 2048 openssl req -new -key client.key -out client.csr openssl x509 -req -days 365 -in client.csr -CA ca.crt -CAkey ca.key -set_serial 01 -out client.crt openssl pkcs12 -export -clcerts -in client.crt -inkey client.key -out client.p12 openssl pkcs12 -in client.p12 -out client.pem -clcerts
Copy client.pem, client.key, and ca.crt
to the supplicant device, then load them into the PKI:
set security pki ca-profile test_ca ca-identity cai set protocols dot1x supplicant interface et-0/0/49.0 local-certificate switch_cert request security pki ca-certificate load filename /var/tmp/ca.crt ca-profile test_ca request security pki local-certificate load certificate-id switch_cert filename /var/tmp/client.pem key /var/tmp/client.key passphrase client123
You must specify a local certificate identifier in the PKI configuration; EAP-TLS cannot operate without one.
On the RADIUS server, update the tls section of eap.conf
to reference the server key, certificate, CA certificate, and private key passphrase:
tls {
raddbdir = /usr/local/etc/raddb
private_key_password = server123
private_key_file = ${raddbdir}/certs/server.key
certificate_file = ${raddbdir}/certs/server.pem
ca_file = ${raddbdir}/certs/new/ca.crt
}Verifying 802.1X Wired Supplicant Operation
Display supplicant status for all interfaces:
root@switch1> show dot1x supplicant
ge-0/0/23.0
Role: Supplicant
Supplicant: abdhs, E8:24:A6:09:62:1B
Operational state: Authenticated
Authentication method: eap-md5Display detailed status for a specific interface:
root@switch1> show dot1x supplicant interface ge-0/0/23 detail
ge-0/0/23.0
Role: Supplicant
Supplicant: abdhs, E8:24:A6:09:62:1B
Operational state: Authenticated
Authentication method: eap-md5Display a summary table across interfaces:
root@switch1> show dot1x supplicant interface 802.1X Information: Interface Role State MAC address User ge-0/0/18.0 Supplicant Authenticated E8:24:A6:09:62:16 anonymous
Confirm that Operational state shows Authenticated. A state of
Held indicates an authentication failure.
To restart authentication (for example, after changing credentials or updating a certificate):
root@switch1> clear dot1x supplicant interface
Troubleshooting
When 802.1X client authentication is unsuccessful, the client moves to the held state, and a syslog message reports the specific reason. Common failure reasons include:
- Invalid credential
- Server unreachable
- Insufficient VLAN attributes received from the RADIUS server
- VLAN or VoIP-VLAN validation failed
- Invalid attribute or unsupported attribute for the interface type (for example, redirect-URL, VoIP-VLAN, or dynamic-VLAN attributes are not supported on trunk or Layer 3 interfaces)
- Egress VLAN validation or range errors
- Filter creation or tokenizing errors
- Invalid redirect URL
You can check held clients using:
show dot1x interface show dot1x interface detail show dot1x authentication-failed-users
Syslog Messages
The following table summarizes the syslog messages generated for supplicant session state
changes. All event IDs are existing Junos events; the enhancement adds a failure reason to
the held-state message and raises severity to LOG_NOTICE for held and
disconnected events.
| Scenario | Event ID | Severity | Sample Message |
|---|---|---|---|
| Client held | DOT1XD_USR_SESSION_HELD |
LOG_NOTICE | Dot1x User vvvv session with MacAddress 00:01:02:03:04:05 interface ae1.0 vlan (null) is held due to reason <Invalid credential> |
| Client authenticated | DOT1XD_USR_AUTHENTICATED |
LOG_NOTICE | Custom_log Dot1x User host1 logged in MacAddress 00:10:94:00:00:01 interface ge-0/0/20.0 vlan VLAN_1 |
| Client disconnected | DOT1XD_USR_SESSION_DISCONNECTED |
LOG_NOTICE | Dot1x User host1 session with MacAddress 00:10:94:00:00:01 interface ge-0/0/20.0 vlan (null) disconnected due to reason <EAP log-off> |
| Client authenticated in guest VLAN | DOT1XD_USR_ATHNTICTD_GST_VLAN |
LOG_NOTICE | Dot1x User host1 non responsive host 00:10:94:00:00:01 on interface ge-0/0/1 moved to guest vlan vlan100 |
| Client authenticated on server-fail VLAN | DOT1XD_USR_ON_SRVR_FAIL_VLAN |
LOG_NOTICE | Dot1x User host1 logged in MacAddress 00:10:94:00:00:01 interface ge-0/0/1 authenticated on server fail vlan vlan100 |
| Client authenticated on server-reject VLAN | DOT1XD_USR_ON_SRVR_REJECT_VLAN |
LOG_NOTICE | Dot1x User host1 logged in MacAddress 00:10:94:00:00:01 interface ge-0/0/1 authenticated on server reject vlan vlan100 |