H3C 云简网络 绿洲平台 部署固定账户认证方式提示“由于商户原因认证失败”案例

#

 dns server 114.114.114.114

#

wlan service-template wuxian

 ssid XTJSDS

 vlan 200

 client forwarding-location ac

 quick-association enable

 portal enable method direct

 portal domain cloud

 portal apply web-server wuxian

 portal temp-pass period 20 enable

 service-template enable

#

interface Vlan-interface999

 ip address 192.168.199.2 255.255.255.0  //WAC与云简网络互联IP地址

#

 ip route-static 0.0.0.0 0 192.168.199.1

#

 portal host-check enable

 portal client-gateway interface Vlan-interface999

 portal free-rule 2346257224 destination open.weixin.qq.com

 portal free-rule 2346257225 destination ip any tcp 5223

 portal free-rule 2346257226 destination ip 114.114.114.114 255.255.255.255

 portal free-rule 2346257227 destination ip any udp 53

 portal free-rule 2346257228 destination ip any tcp 53

 portal free-rule 2346257229 destination oasisauth.h3c.com

 portal free-rule 2346257230 destination short.weixin.qq.com

 portal free-rule 2346257231 destination mp.weixin.qq.com

 portal free-rule 2346257232 destination long.weixin.qq.com

 portal free-rule 2346257233 destination dns.weixin.qq.com

 portal free-rule 2346257234 destination minorshort.weixin.qq.com

 portal free-rule 2346257235 destination extshort.weixin.qq.com

 portal free-rule 2346257236 destination szshort.weixin.qq.com

 portal free-rule 2346257237 destination szlong.weixin.qq.com

 portal free-rule 2346257238 destination szextshort.weixin.qq.com

 portal free-rule 2346257239 destination isdspeed.qq.com

 portal free-rule 2346257240 destination ***.***

 portal free-rule 2346257241 destination long.open.weixin.qq.com

 portal free-rule 2346257242 destination res.wx.qq.com

 portal free-rule 2346257243 destination wifi.weixin.qq.com

 portal safe-redirect enable

 portal safe-redirect method get post

 portal safe-redirect user-agent Android

 portal safe-redirect user-agent CaptiveNetworkSupport

 portal safe-redirect user-agent MicroMessenger

 portal safe-redirect user-agent Mozilla

 portal safe-redirect user-agent WeChat

 portal safe-redirect user-agent micromessenger

#

portal web-server wuxian

 url http://oasisauth.h3c.com/portal/protocol

 server-type oauth

 if-match user-agent CaptiveNetworkSupport redirect-url http://oasisauth.h3c.com/generate_404

 if-match user-agent Dalvik/2.1.0(Linux;U;Android7.0;HUAWEI redirect-url http://oasisauth.h3c.com/generate_404

 if-match original-url http://10.168.168.168 temp-pass

 if-match original-url http://captive.apple.com user-agent Mozilla temp-pass redirect-url http://oasisauth.h3c.com/portal/protocol

 if-match original-url ***.***/wifi/echo temp-pass redirect-url http://oasisauth.h3c.com/generate_404

 if-match original-url http://www.apple.com user-agent Mozilla temp-pass redirect-url http://oasisauth.h3c.com/portal/protocol

#

portal local-web-server http

#

portal local-web-server https

#

 netconf soap http enable

#

 ip http enable

 ip https enable

#

portal mac-trigger-server cloud

 binding-retry 2 interval 3

 cloud-binding enable

#

 smartmc tc enable

#

 wlan auto-ap enable

 wlan auto-persistent enable

#

wlan ap-group default-group

 vlan 1

 ap-model WAP722S-W2

  radio 1

   radio enable

   service-template wuxian

  radio 2

   radio enable

   service-template wuxian

  gigabitethernet 1

#

 cloud-management server domain oasis.h3c.com

#

检查WAC 本地与云简网络互联的TCP连接信息，发现异常：

[WAC] display tcp verbose | b portal

......

Creator: portald[8716]
 State: ISCONNECTED 
 Options: SO_SEQPACKET 
 Error: 0
 Receiving buffer(cc/hiwat/lowat/drop/state): 0 / 66364 / 1 / 0 / CANTREDUCESIZE 
 Sending buffer(cc/hiwat/lowat/state): 0 / 64952 / 512 / N/A
 Type: 1
 Protocol: 6
 Connection info: Src = 192.168.199.2:58137, Dst = 101.36.161.143:443  //WAC 与错误的云简网络IP和端口建立了连接
 Inpcb flags: INP_ANONPORT INP_SYNCPCB 
 Inpcb extflag: N/A
 Inpcb vflag: INP_IPV4 
 TTL: 255(minimum TTL: 0)
 Connection state: ESTABLISHED
 TCP options: TF_NODELAY TF_REQ_SCALE TF_RCVD_SCALE TF_REQ_TSTMP TF_SACK_PERMIT 
 NSR state: CLOSED(M)
 Send VRF: 0x0
 Receive VRF: 0x0

通过上述查看，已找到故障的原因。导致 WAC 与错误的云简网络IP和端口建立了连接的由于云简网络在长期的运维过程中 H3C 公司对其域名更换了相关IP地址，导致WAC 还在向已停用的云简网络IP 发送请求消息。

目前正确的云简网络IP地址端口应该为：101.36.161.146:80。