diff --git a/tests/nexus/test_1_1_8_1_1.cpp b/tests/nexus/test_1_1_8_1_1.cpp
index 30135c27a..7bb284c77 100644
--- a/tests/nexus/test_1_1_8_1_1.cpp
+++ b/tests/nexus/test_1_1_8_1_1.cpp
@@ -47,7 +47,7 @@ static constexpr uint32_t kCommissionerStartTime = 1 * Time::kOneSecondInMsec;
 /**
  * Time to advance for the Joiner to complete the joining process, in milliseconds.
  */
-static constexpr uint32_t kJoiningProcessTime = 30 * Time::kOneSecondInMsec;
+static constexpr uint32_t kJoiningProcessTime = 60 * Time::kOneSecondInMsec;
 
 /**
  * The timeout for the Joiner entry on Commissioner, in seconds.
@@ -200,6 +200,7 @@ void Test1_1_8_1_1(void)
 #endif
 
     SuccessOrQuit(commissioner.AddJoinerAny(kPskd, kJoinerTimeout));
+    nexus.AdvanceTime(Time::kOneSecondInMsec);
 
     Log("---------------------------------------------------------------------------------------");
     Log("Step 3: Joiner_1");
diff --git a/tests/nexus/verify_1_1_8_1_1.py b/tests/nexus/verify_1_1_8_1_1.py
index e6a83fb24..6be6b9e50 100644
--- a/tests/nexus/verify_1_1_8_1_1.py
+++ b/tests/nexus/verify_1_1_8_1_1.py
@@ -46,6 +46,7 @@ JOIN_ENT_URI = '/c/je'
 NM_PROVISIONING_URL_TLV = 32
 MLE_SEC_SUITE_NONE = 255
 JOINER_UDP_PORT = 49153
+
 ALERT_DESC_CLOSE_NOTIFY = 0
 ALERT_LEVEL_FATAL = 2
 DTLS_PORT = 1000
@@ -245,20 +246,9 @@ def verify(pv):
         filter(lambda p: p.udp.srcport in COMMISSIONER_UDP_PORTS).\
         must_next()
 
-    #   - 13. Joiner_1 sends an encrypted DTLS-Alert record with a code of 0 (close_notify) to Commissioner.
-    #   Note: OpenThread Joiner sends close_notify immediately after receiving JOIN_FIN.rsp, while it expects
-    #   JOIN_ENT.ntf over the mesh. The spec lists 11, 12, 13 but these are independent exchanges.
-    print("Step 5.13: Joiner_1 sends DTLS-Alert (close_notify).")
-    pkts.filter_wpan_src64(JOINER).\
-        filter_wpan_dst64(COMMISSIONER).\
-        filter(lambda p: consts.CONTENT_ALERT in p.dtls.record.content_type).\
-        filter(lambda p: p.dtls.alert_message.desc == ALERT_DESC_CLOSE_NOTIFY).\
-        filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\
-        must_next()
-
     #   - 11. Commissioner sends an encrypted JOIN_ENT.ntf message to Joiner_1.
     print("Step 5.11: Commissioner sends JOIN_ENT.ntf (Encrypted).")
-    pkts.filter_wpan_src64(COMMISSIONER).\
+    pkts.copy().filter_wpan_src64(COMMISSIONER).\
         filter_wpan_dst64(JOINER).\
         filter(lambda p: p.wpan.security == True).\
         must_next()
@@ -266,11 +256,22 @@ def verify(pv):
     #   - 12. Joiner_1 receives the encrypted JOIN_ENT.ntf message and sends an encrypted JOIN_ENT.ntf dummy response
     #     to Commissioner.
     print("Step 5.12: Joiner_1 sends JOIN_ENT.ntf response (Encrypted).")
-    pkts.filter_wpan_src64(JOINER).\
+    pkts.copy().filter_wpan_src64(JOINER).\
         filter_wpan_dst64(COMMISSIONER).\
         filter(lambda p: p.wpan.security == True).\
         must_next()
 
+    #   - 13. Joiner_1 sends an encrypted DTLS-Alert record with a code of 0 (close_notify) to Commissioner.
+    #   Note: OpenThread Joiner sends close_notify immediately after receiving JOIN_FIN.rsp, while it expects
+    #   JOIN_ENT.ntf over the mesh. The spec lists 11, 12, 13 but these are independent exchanges.
+    print("Step 5.13: Joiner_1 sends DTLS-Alert (close_notify).")
+    pkts.copy().filter_wpan_src64(JOINER).\
+        filter_wpan_dst64(COMMISSIONER).\
+        filter(lambda p: consts.CONTENT_ALERT in p.dtls.record.content_type).\
+        filter(lambda p: p.dtls.alert_message.desc == ALERT_DESC_CLOSE_NOTIFY).\
+        filter(lambda p: p.udp.dstport in COMMISSIONER_UDP_PORTS).\
+        must_next()
+
     # Fail Conditions:
     #   - 3. A DTLS-Alert record with a Fatal alert level is sent by either Joiner_1 or Commissioner.
     print("Check for no Fatal DTLS alerts.")
diff --git a/tests/scripts/thread-cert/pktverify/layer_fields.py b/tests/scripts/thread-cert/pktverify/layer_fields.py
index 8267808dc..811e98a8b 100644
--- a/tests/scripts/thread-cert/pktverify/layer_fields.py
+++ b/tests/scripts/thread-cert/pktverify/layer_fields.py
@@ -562,6 +562,7 @@ _LAYER_FIELDS = {
     'dtls.handshake.cookie': _auto,
     'dtls.record.content_type': _list(_auto),
     'dtls.alert_message.desc': _auto,
+    'dtls.alert_message.level': _auto,
 
     # thread beacon
     'thread_bcn.protocol': _auto,