无线控制器对接IMC做MAC地址认证
IMC上看到同一用户频繁上下线,导致业务无法正常使用
1、核对设备以及IMC侧配置没问题
2、采集设备侧debug信息发现大量用户存在短时间内认证次数达到IMC设置的阈值而导致认证失败的现象
*Mar 24 11:06:44:451 2021 HFEPC-AC-WX3510 RADIUS/7/PACKET:
User-Name="34de1a7911e8"
User-Password=******
Service-Type=Call-Check
Framed-Protocol=PPP
NAS-Identifier="HFEPC-AC-WX3510"
NAS-Port=16779316
NAS-Port-Type=Wireless-802.11
NAS-Port-
Calling-Station-
Called-Station-
H3c-Nas-Startup-Timestamp=1601632549
Acct-Session-
H3c-User-Vlan-Id=2100
H3c-Ip-Host-Addr="0.0.0.0 34:de:1a:79:11:e8"
NAS-IP-Address=10.11.72.230
H3c-Product-
*Mar 24 11:06:44:452 2021 HFEPC-AC-WX3510 RADIUS/7/PACKET:
01 b1 01 15 75 9d 54 b4 d2 6c 5c b8 79 5a 93 ff //设备发送code 1认证请求报文
45 5d 55 24 01 0e 33 34 64 65 31 61 37 39 31 31
65 38 02 12 2f 91 f1 10 e4 be 10 92 62 58 b6 20
90 96 51 4d 06 06 00 00 00 0a 07 06 00 00 00 01
20 11 48 46 45 50 43 2d 41 43 2d 57 58 33 35 31
30 05 06 01 00 08 34 3d 06 00 00 00 13 57 12 30
31 30 30 30 30 30 30 30 30 30 30 32 31 30 30 1f
13 33 34 2d 44 45 2d 31 41 2d 37 39 2d 31 31 2d
45 38 1e 19 39 43 2d 45 38 2d 39 35 2d 39 46 2d
33 32 2d 45 30 3a 68 66 65 70 63 1a 0c 00 00 63
a2 3b 06 5f 76 f9 25 2c 28 30 30 30 30 30 30 30
34 32 30 32 31 30 33 32 34 31 31 30 36 34 34 30
31 34 36 64 37 63 38 30 38 31 30 30 34 30 34 1a
0c 00 00 63 a2 85 06 00 00 08 34 1a 21 00 00 63
a2 3c 1b 30 2e 30 2e 30 2e 30 20 33 34 3a 64 65
*Mar 24 11:06:44:453 2021 HFEPC-AC-WX3510 RADIUS/7/PACKET:
3a 31 61 3a 37 39 3a 31 31 3a 65 38 04 06 0a 0b
48 e6 1a 13 00 00 63 a2 ff 0d 48 33 43 20 57 58
33 35 31 30 48
*Mar 24 11:06:44:453 2021 HFEPC-AC-WX3510 RADIUS/7/PACKET:
Reply-Message="E63620: The request is dropped by UAM because of 21 consecutive authentication failures. Please try again 1 minutes later." 由于短时间内认证次数达到IMC设置的阈值,所以IMC回复code3认证失败的报文
*Mar 24 11:06:44:454 2021 HFEPC-AC-WX3510 RADIUS/7/PACKET:
03 b1 00 90 b2 fb 0b fb 58 94 ee 92 66 ce 43 f0 //IMC回复code3认证拒绝报文
8e e8 94 2c 12 7c 45 36 33 36 32 30 3a 20 54 68
65 20 72 65 71 75 65 73 74 20 69 73 20 64 72 6f
70 70 65 64 20 62 79 20 55 41 4d 20 62 65 63 61
75 73 65 20 6f 66 20 32 31 20 63 6f 6e 73 65 63
75 74 69 76 65 20 61 75 74 68 65 6e 74 69 63 61
74 69 6f 6e 20 66 61 69 6c 75 72 65 73 2e 20 50
6c 65 61 73 65 20 74 72 79 20 61 67 61 69 6e 20
31 20 6d 69 6e 75 74 65 73 20 6c 61 74 65 72 2e
3、MAC地址认证和802.1X认证都是准入认证,在终端漫游后都需要重新认证,因此怀疑终端频繁漫游导致频繁认证,在AC上查看某一终端的漫游轨迹,发现确实存在频繁漫游的现象
display wlan mobility roam-track mac-address 0871-9094-d388
Total entries: 54
Current entries: 54
BSSID Created at Online time AC IP address RID AP name
9ce8-959f-4c10 2021-03-24 12:19:59 00h 08m 48s 127.0.0.1 2 y1f03
307b-acd5-6670 2021-03-24 12:17:32 00h 02m 27s 127.0.0.1 2 y2f05
9ce8-959f-4c10 2021-03-24 12:14:30 00h 03m 02s 127.0.0.1 2 y1f03
307b-acd5-6670 2021-03-24 12:13:31 00h 01m 00s 127.0.0.1 2 y2f05
9ce8-959f-89d0 2021-03-24 12:12:56 00h 00m 35s 127.0.0.1 2 y3f03
9ce8-959f-4c10 2021-03-24 11:54:38 00h 18m 17s 127.0.0.1 2 y1f03
9ce8-9592-6670 2021-03-24 11:54:24 00h 00m 15s 127.0.0.1 2 y2f04
9ce8-9592-6680 2021-03-24 11:54:18 00h 00m 04s 127.0.0.1 3 y2f04
9ce8-959f-32f0 2021-03-24 11:54:13 00h 00m 05s 127.0.0.1 2 y3f07
9ce8-959f-6170 2021-03-24 11:54:02 00h 00m 10s 127.0.0.1 2 y4f08
9ce8-959e-d510 2021-03-24 11:53:46 00h 00m 17s 127.0.0.1 2 y4f02
9ce8-959f-6170 2021-03-24 11:53:34 00h 00m 12s 127.0.0.1 2 y4f08
88df-9e1f-8690 2021-03-24 11:53:25 00h 00m 08s 127.0.0.1 2 y4f01
9ce8-9592-6680 2021-03-24 11:53:20 00h 00m 05s 127.0.0.1 3 y2f04
9ce8-9592-6b10 2021-03-24 11:53:12 00h 00m 08s 127.0.0.1 1 y6f03
9ce8-9592-6b20 2021-03-24 11:53:07 00h 00m 05s 127.0.0.1 2 y6f03
dcda-8005-3b60 2021-03-24 11:52:58 00h 00m 09s 127.0.0.1 1 y1f06
88df-9e93-d290 2021-03-24 11:25:32 00h 27m 26s 127.0.0.1 3 y2f02
dcda-8005-3b60 2021-03-24 11:25:00 00h 00m 32s 127.0.0.1 1 y1f06
9ce8-9592-6b30 2021-03-24 11:24:55 00h 00m 05s 127.0.0.1 3 y6f03
9ce8-959f-6410 2021-03-24 11:24:25 00h 00m 30s 127.0.0.1 2 y3f02
9ce8-959f-8570 2021-03-24 11:24:13 00h 00m 12s 127.0.0.1 2 y3f04
9ce8-959f-8560 2021-03-24 11:24:09 00h 00m 05s 127.0.0.1 1 y3f04
9ce8-959f-5f30 2021-03-24 11:24:02 00h 00m 06s 127.0.0.1 2 y4f09
9ce8-959f-4c10 2021-03-24 11:16:04 00h 07m 58s 127.0.0.1 2 y1f03
9ce8-9592-6660 2021-03-24 11:15:12 00h 00m 53s 127.0.0.1 1 y2f04
307b-acd5-6670 2021-03-24 11:11:09 00h 04m 02s 127.0.0.1 2 y2f05
9ce8-959f-4c10 2021-03-24 11:07:47 00h 03m 23s 127.0.0.1 2 y1f03
307b-acd5-38c0 2021-03-24 11:07:42 00h 00m 05s 127.0.0.1 1 y1f05
9ce8-959f-69b0 2021-03-24 11:07:36 00h 00m 05s 127.0.0.1 2 y3f09
88df-9e93-a200 2021-03-24 11:07:23 00h 00m 14s 127.0.0.1 3 y2f03
88df-9e93-d290 2021-03-24 11:07:14 00h 00m 08s 127.0.0.1 3 y2f02
88df-9e93-d270 2021-03-24 11:07:09 00h 00m 06s 127.0.0.1 1 y2f02
88df-9e1f-8690 2021-03-24 11:06:57 00h 00m 11s 127.0.0.1 2 y4f01
dcda-8005-3b70 2021-03-24 10:58:40 00h 08m 17s 127.0.0.1 2 y1f06
88df-9e93-d290 2021-03-24 10:55:39 00h 03m 01s 127.0.0.1 3 y2f02
9ce8-959f-89d0 2021-03-24 10:52:49 00h 00m 10s 127.0.0.1 2 y3f03
9ce8-9592-6660 2021-03-24 10:52:36 00h 00m 13s 127.0.0.1 1 y2f04
9ce8-959f-4c00 2021-03-24 10:52:31 00h 00m 05s 127.0.0.1 1 y1f03
307b-acd5-6670 2021-03-24 10:50:16 00h 02m 15s 127.0.0.1 2 y2f05
9ce8-959f-4c10 2021-03-24 10:49:32 00h 00m 44s 127.0.0.1 2 y1f03
9ce8-959f-5f30 2021-03-24 10:48:24 00h 01m 07s 127.0.0.1 2 y4f09
9ce8-959e-d4d0 2021-03-24 10:48:14 00h 00m 10s 127.0.0.1 2 y4f03
9ce8-959f-6410 2021-03-24 10:47:53 00h 00m 22s 127.0.0.1 2 y3f02
dcda-8005-3b70 2021-03-24 10:43:37 00h 04m 15s 127.0.0.1 2 y1f06
9ce8-959f-4c10 2021-03-24 10:39:16 00h 02m 40s 127.0.0.1 2 y1f03
9ce8-959f-4c00 2021-03-24 10:38:51 00h 00m 26s 127.0.0.1 1 y1f03
9ce8-959f-4c00 2021-03-24 10:38:49 00h 00m 01s 127.0.0.1 1 y1f03
9ce8-959f-4c00 2021-03-24 10:37:37 00h 00m 51s 127.0.0.1 1 y1f03
9ce8-959f-4c00 2021-03-24 10:37:35 00h 00m 02s 127.0.0.1 1 y1f03
9ce8-959f-4c00 2021-03-24 10:35:58 00h 00m 18s 127.0.0.1 1 y1f03
9ce8-959f-4c00 2021-03-24 10:33:21 00h 02m 34s 127.0.0.1 1 y1f03
307b-acd5-6660 2021-03-24 10:33:15 00h 00m 06s 127.0.0.1 1 y2f05
9ce8-959f-4c00 2021-03-24 10:33:01 00h 00m 14s 127.0.0.1 1 y1f03
优化每个AP射频口发射功率,尽量保证AP间信号不重叠,解决终端频繁漫游的问题,MAC认证终端频繁下线的问题迎刃而解;
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作