某局点WX5540H Portal 对接第三方服务器认证失败问题处理经验案例

无

某局点采用WX5540H 做portal认证，服务器采用的是第三方服务器，配置好之后，发现能正常弹出portal界面，但是输入用户名和密码之后，提示设备拒绝请求，查看设备侧配置，并无发现异常，确认两边nas-ip和bas-ip 也都对应的上，基本无问题。

设备侧配置：

wlan service-template 1
ssid TEST
client forwarding-location ap vlan 2031
portal enable method direct
portal domain 123
portal bas-ip 192.168.x.x
portal apply web-server 123
portal apply mac-trigger-server 123
service-template enable

radius scheme 123
primary authentication x.x.x.x
primary accounting x.x.x.x
key authentication cipher $c$3$VY+oALO9urS0v3EZqWOtR/DLbpvlBMtu6A==
key accounting cipher $c$3$x3El1KhAxpMl9anDFajju5G/jpZPeh3scw==
nas-ip 192.168.x.x

domain 123
authentication portal radius-scheme 123
authorization portal radius-scheme 123
accounting portal radius-scheme 123

portal web-server 123
url http://x.x.x.x/index_5.html
url-parameter ssid ssid
url-parameter wlanacname value AC
url-parameter wlanuserip source-address

portal server 123
ip x.x.x.x key cipher $c$3$Ovapw7oNv+To7hSyLL/O5MJ1KlwD6z6DBg==
server-type cmcc

由于配置暂看不出异常，建议收集debug portal all 和debug radius all，通过查看debug信息发现，设备已收到req_auth报文，开始封装radius 报文了，但是提示封装失败，一般提示这个报错是由于两端的portal协议类型不一致导致。设备侧配置的是CMCC，是属于portal1.0，怀疑第三方服务器侧用的是portal2.0，导致认证失败。

*May  9 16:40:36:547 2020 AC控制器 PORTAL/7/PACKET:
Portal received 80 bytes of packet: Type=req_auth(3), ErrCode=0, IP=x.x.x.x
*May  9 16:40:36:547 2020 AC控制器 PORTAL/7/PACKET:
02 03 00 00 d8 21 00 c6 0a 04 97 88 00 00 00 04
a9 19 b6 97 ec 29 3c 2a 91 e3 5e c3 ee 97 0c 15
01 06 74 65 73 74 04 12 67 c4 7d f3 3c f5 7d cf
2f cb 87 c0 d9 94 8b 32 03 12 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 0a 06 00 00 00 00

*May  9 16:40:36:547 2020 AC控制器 RADIUS/7/EVENT:
PAM_RADIUS: Processing RADIUS authentication.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
PAM_RADIUS: Sent authentication request successfully.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Processing AAA request data.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Got request data successfully, primitive: authentication.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Getting RADIUS server info.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Got RADIUS server info successfully.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Created request context successfully.
*May  9 16:40:36:548 2020 AC控制器 RADIUS/7/EVENT:
Created request packet successfully, dstIP: x.x.x.x, dstPort: 1812, VPN instance: --(public), socketFd: 96, pktID: 237.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/EVENT:
Added packet socketfd to epoll successfully, socketFd: 96.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/EVENT:
Mapped PAM item to RADIUS attribute successfully.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/ERROR:
Failed to fill RADIUS attribute in packet.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/ERROR:
Failed to compose request packet.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/ERROR:
Failed to send request packet and create request context.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/EVENT:
Sent reply message successfully.
*May  9 16:40:36:549 2020 AC控制器 RADIUS/7/EVENT:
PAM_RADIUS: Processing RADIUS authentication.
*May  9 16:40:36:550 2020 AC控制器 RADIUS/7/EVENT:
Processing AAA request data.
*May  9 16:40:36:550 2020 AC控制器 RADIUS/7/EVENT:
PAM_RADIUS: Fetched authentication reply-data successfully, resultCode: 4
*May  9 16:40:36:550 2020 AC控制器 PORTAL/7/PACKET:
Portal sent 16 bytes of packet: Type=ack_auth(4), ErrCode=1, IP=x.x.x.x

把设备侧server-type 改成imc之后，重新测试之后，问题解决，认证成功。

总结：设备侧配置CMCC 是portal1.0，IMC是portal2.0，设备侧需要跟服务器侧对应上，否则就会提示radius 报文封装失败的报错。

portal server 123
ip x.x.x.x key cipher $c$3$Ovapw7oNv+To7hSyLL/O5MJ1KlwD6z6DBg==
server-type imc