I'm trying to set up MAC authorization with 802.1X using FreeRADIUS, a Dell N2048 (DN OS6.3.3.9) switch as the authenticator and a Ubuntu machine as the supplicant. I've followed this guide for configuring FreeRADIUS : https://wiki.freeradius.org/guide/Mac-Auth#plain-mac-auth

My FreeRADIUS config files looks like this (MAC addresses have been replaced) :

sudo cat /etc/freeradius/3.0/sites-available/default
listen {
        type = auth
        ipaddr =
        port = 0
        limit {
              max_connections = 16
              lifetime = 0
              idle_timeout = 30

authorize {

            if (!ok) {
            else {
                update control {
                    Cleartext-Password := &Calling-Station-ID
                    Auth-Type = Accept
sudo cat /etc/freeradius/3.0/mods-available/files
files authorized_macs {
        key = "%{Calling-Station-ID}"
        usersfile = ${confdir}/authorized_macs
sudo cat /etc/freeradius/3.0/authorized_macs
        Cleartext-Password := "AA-BB-CC-DD-EE-FF",
        User-Name := "AA-BB-CC-DD-EE-FF",
        Service-Type = Framed-User,
        Tunnel-Type = VLAN,
        Tunnel-Medium-Type = 6,
        Tunnel-Private-Group-id = 150,
        Reply-Message = "Device %{Calling-Station-ID} authorized"

The wpa_supplicant.conf on the Ubuntu client :


The switch dot1x config :

dot1x system-auth-control
aaa authentication dot1x default radius
aaa authorization network default radius
radius-server host auth
name "Default-RADIUS-Server"
usage 802.1x
key 7 "..."
interface Gi1/0/1
switchport mode general
dot1x port-control mac-based
dot1x mac-auth-bypass

With this configuration everything is processed correctly. The RADIUS server is authorizing the supplicant based on its MAC address. However, the switch refuse the EAP Access-Accept from the server. And I'm lost here. The only clue the switch gives me is that the EAP packet is malformed :

<189> Aug  2 10:28:08 dell-n2048p-users-1-1 DOT1X[dot1xTask]: dot1x_radius.c(654) 58882 %% EAP message not received from server.RADIUS server did not send required EAP message.
<189> Aug  2 10:27:08 dell-n2048p-users-1-1 DOT1X[dot1xTask]: dot1x_radius.c(654) 58879 %% EAP message not received from server.RADIUS server did not send required EAP message.
<190> Aug  2 10:27:08 dell-n2048p-users-1-1 RADIUS[dot1xTask]: radius_api.c(1002) 58878 %% RADIUS: radiusAccessRequestMsgSend(): Updated Global radius server entry with ipaddr'

It's also shown on the supplicant through Wireshark.
I've tried using the supplicant MAC address as username and password, and making it a Framed-User but it doesn't change anything. I've added the MAC address as a Cleartext-Password into the EAP response message (Cleartext-Password := &Calling-Station-ID) in case this would be accepted but it doesn't change anything either. Enabling MAB doesn't seem to do anything, even by tweaking the timeouts.

Am I missing something in the config ? What could make the EAP response being treated as a malformed packet ?


  • What makes you conclude that "everything is processed correctly"?. Why do you think, the switch refuses the EAP Access-Accept from the server?. Where do you see that the switch considers the EAP packet as malformed? And what is "it" in 'It's also shown on the supplicant through Wireshark' ?
    – hertitu
    Commented Aug 2, 2019 at 23:44
  • @hertitu I can see that "everything is processed correctly" through the logs given by freeradius -X. I can see the Access-Accept failing on the switch by looking at the logs (on Dell OS6 it's show logging) ; however the switch isn't telling it's an Access-Accept message, only EAP message not received from server.RADIUS server did not send required EAP message.. My main guess is that the switch is refusing the Access-Accpet because of a lack or bad attributes in the message but I'm really not sure and I don't see what could be missing.
    – Pro-oui
    Commented Aug 5, 2019 at 7:50
  • @hertitu The Wireshark thing is a bit ambiguous I realize. On the supplicant, I can see an "EAP Request, Notification" packet received from the switch, more precisely a "Request, Notification[Malformed Packet]" where the correct "Reply-Message" attribute is shown. So I deducted it's actually the EAP Access-Accpet sent by the RADIUS server.
    – Pro-oui
    Commented Aug 5, 2019 at 8:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.