Wireless EAPoL and Wired RADIUS packet capture files Included below are links to download the. In this write up I used a Nexus 6P, Cisco Meraki MR33, and a Cisco ISE server. If you capture at Point 2 we will be seeing the traffic as RADIUS messages. If you capture at Point 1 in the diagram below, the frame exchanges will be using EAPoL as a protocol. There are technically 2 points that you can grab packet captures, both of which will provide relevant information for troubleshooting. The above diagram is utilizing EAP-PEAP, this may look a little different depending on the Auth method. Now that being said I also recommend learning about not only how to debug the RADIUS servers via logs and troubleshooting tools, but being able to understand what it looks like from a packet capture perspective both wired and wireless and all the information you can glean from a pcap. Meraki Common RADIUS Error Codes with Microsoft NPS A few great resources I have used and/or reviewed are:

As long as you can understand that protocol to a fairly deep level you can troubleshoot any RADIUS environment. One thing to keep in mind is that while every vendor of a dot1x solution (Cisco, Aruba, FreeRADIUS, Microsoft) has a certain way of going about authentication, they all fall back to the same protocol: 802.1X/RADIUS. …By taking advantage of the resources that are out there as well as practical labs. So the question is, how do we become masters of a protocol that is literally quite capable of being the success or demise of a network’s security and operation?

I personally learned a lot about dot1x via trial and error through implementations in the past as well as lab time at home and during my CCIE studies. That being said a lot of times we as engineers get stuck in a state of understanding enough to be dangerous and not enough to be highly successful and more importantly, capable. This was a great idea, so please enjoy!Ĩ02.1X is typically the first step in one of the more advanced security implementations you will have to dip your toes into when moving your network to a secure state.

He has graciously asked that I add a little more details including the packet captures so everyone can follow along. EDIT: After chatting with David Westcott I have made a few additions to this post.

Viewing mac address wireshark pcap