iMC EIA Portal认证下线原因为Nas-error的典型问题分析

EIA Portal认证成功后，用户异常下线，查看下线原因为nas-error。客户表示设备配置没有动过，之前都是正常，之前也有部分用户nas-error下线，最近逐渐增多。

1、收集信息

复现问题，iMC侧收集UAM和portal调试级别日志，同时设备上收集debug信息。反馈测试账号名和用户的IP地址。

UAM调试日志收集方法：

先将日志级别设置成“调试”级别（收集完后再调成信息级别）。

复现问题2—3次，收集iMC安装目录/UAM/Log下当天的日志

portal日志的收集方法：

先将portal日志级别改成调试，然后复现问题，最后收集日志（收集完后再调成信息级别）。日志路径：iMC安装路径/portal/log （只收当天的日志）。

设备侧debug信息收集方法：

debug portal all interface vlan XXX

debug radius packet

debug portal error

debug sc all

2、分析UAM调试日志

UAM日志记录，认证成功后，很快收到设备发的下线报文，下线原因：nas-error 。

% 2015-01-14 16:26:09 ; [L_DEBUG (4)] ; [109288] ; LAN ; 100880 ; 4 ; ab2fd1f733c343bba0404af3849a900d ; (NULL) ; RT[1]: Receive message from 10.10.5.1:

CODE = 4.

ID   = 215.

ATTRIBUTES:

         User-Name(1) = "100880".

         NAS-Identifier(32) = "center-7506E".

         NAS-Port(5) = 84070924.

         NAS-Port-Id(87) = "0500045000000524".

         NAS-Port-Type(61) = 15.

         Calling-Station-Id(31) = "EC-88-8F-FD-C3-31".

         Acct-Status-Type(40) = 2.

         Acct-Authentic(45) = 1.

         Acct-Session-Id(44) = "115001415226dad000".

         Framed-IP-Address(8) = 170556547.

         NAS-IP-Address(4) = 168428801.

         Event-Timestamp(55) = 1421220178.

         Acct-Session-Time(46) = 0.

         Acct-Delay-Time(41) = 0.

         Acct-Input-Octets(42) = 0.

         Acct-Input-Packets(47) = 0.

         Acct-Output-Octets(43) = 0.

         Acct-Output-Packets(48) = 0.

         Acct-Input-Gigawords(52) = 0.

         Acct-Output-Gigawords(53) = 0.

         Acct-Terminate-Cause(49) = 9.   //下线原因为Nas-error

         hw_Connect_ID(26) = 320012288.

3、分析设备debug信息

分析设备的debug信息，有大量ACL资源不足的提示信息。

%Jan 14 15:22:36:543 2015 center-7506E PORTAL/4/PORTAL_ACL_FAILURE: -Slot=5; No enough resources.

*Jan 14 15:22:36:544 2015 center-7506E PORTAL/7/PORTAL_DEBUG:

Portal send packet length:93

通过display acl resource命令观察下设备IFP ACL资源，使用率已经超过86%。

另外查看设备侧配置，发现配置了大量的portal free-rule命令，而portal free-rule命令是很耗费ACL资源的。

portal free-rule 1 source ip any destination ip 202.103.44.150 mask 255.255.255.255

portal free-rule 2 source ip 10.42.0.0 mask 255.255.0.0 destination ip 10.42.0.0 mask 255.255.0.0

portal free-rule 3 source ip 10.42.121.0 mask 255.255.255.248 destination ip any

portal free-rule 4 source ip 10.42.124.104 mask 255.255.255.248 destination ip any

portal free-rule 5 source ip 10.42.22.55 mask 255.255.255.255 destination ip any

portal free-rule 6 source ip any destination ip 192.168.200.0 mask 255.255.255.0

portal free-rule 7 source ip any destination ip 202.103.24.68 mask 255.255.255.255

portal free-rule 8 source ip 10.42.26.53 mask 255.255.255.255 destination ip any

portal free-rule 9 source ip 10.42.24.100 mask 255.255.255.255 destination ip any

portal free-rule 10 source ip any destination ip 202.103.0.68 mask 255.255.255.255

portal free-rule 11 source ip 202.110.184.100 mask 255.255.255.255 destination ip any

portal free-rule 12 source ip any destination ip 202.110.184.100 mask 255.255.255.255

portal free-rule 13 source ip any destination ip 202.114.128.2 mask 255.255.255.255

portal free-rule 14 source ip 10.42.102.34 mask 255.255.255.254 destination ip any

portal free-rule 15 source ip 10.168.22.198 mask 255.255.255.255 destination ip any

portal free-rule 16 source ip 10.42.111.144 mask 255.255.255.248 destination ip any

portal free-rule 17 source ip 10.42.89.88 mask 255.255.255.252 destination ip any

portal free-rule 18 source ip 10.42.151.52 mask 255.255.255.254 destination ip any

portal free-rule 19 source ip 10.42.83.148 mask 255.255.255.252 destination ip any

portal free-rule 20 source ip 10.42.13.232 mask 255.255.255.248 destination ip any

portal free-rule 21 source ip 10.42.11.248 mask 255.255.255.248 destination ip any

portal free-rule 22 source ip 10.42.113.171 mask 255.255.255.255 destination ip any

portal free-rule 23 source ip 10.42.27.60 mask 255.255.255.255 destination ip any

portal free-rule 24 source ip 10.42.84.11 mask 255.255.255.255 destination ip any

portal free-rule 25 source ip 10.42.123.123 mask 255.255.255.255 destination ip any

portal free-rule 32 source ip 192.168.254.0 mask 255.255.255.0 destination ip 192.168.200.149 mask 255.255.255.255

portal free-rule 33 source ip 192.168.254.0 mask 255.255.255.0 destination ip 192.168.254.254 mask 255.255.255.255

portal free-rule 34 source ip any destination ip 192.168.219.0 mask 255.255.255.0

portal free-rule 35 source ip 10.42.125.250 mask 255.255.255.255 destination ip any

总结：设备上的信息明确说明，是ACL资源不足导致用户Nas-error下线。

优化设备ACL资源。