WX无线控制器MAC快速认证不成功问题处理案例

客户现场使用S95E AC插卡 + WA2620i-AGN 部署无线网络，客户希望使用MAC快速认证（Portal 无感知认证），完成配置验证发现客户端第二次认证依旧弹出页面要求输入账户和密码认证，无法实现MAC快速认证。

IMC提示终端不支持MAC快速认证。
 

1、IMC认证日志记录测试账户不支持无感知认证，从IMC调试信息中看到如下信息：

% 2015-10-30 15:43:10.218 ; [L_DEBUG (4)] ; [13440] ; LAN ; 1 ; 1 ; e06a520d998647ce8e81fce7a5bb1c2c ; (NULL) ; RT[0]: Receive message from 172.29.1.86:

CODE = 1.

ID   = 17.

ATTRIBUTES:

User-Name(1) = "...1".

CHAP-Password(3) = "744c9b5123b275f7f92cfb6a59af7d7d4f".

CHAP-Challenge(60) = "f6c4a6f00c471eac07cb53162bdca383".

NAS-IP-Address(4) = 2887582038.

NAS-Identifier(32) = "XT_JZNY_AC".

NAS-Port(5) = 16781457.

NAS-Port-Id(87) = "0100001000000145".

NAS-Port-Type(61) = 19.

Service-Type(6) = 2.

Framed-Protocol(7) = 255.

Acct-Session-Id(44) = "11510301540570bd567375".

Framed-IP-Address(8) = 174422274.

hw_Connect_ID(26) = 244.

hw_Product_ID(255) = "LSR1WCM3A1".

hw_IP_Host_Addr(60) = "10.101.121.2 00:00:00:00:00:00".

hw_Nas_Startup_Timetamp(59) = 1443516913.

% 2015-10-30 15:43:10.218 ; [WARNING (2)] ; [13440] ; UAM ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; [GetProxyType] No domain name.

% 2015-10-30 15:43:10.218 ; [L_DEBUG (4)] ; [13440] ; LAN ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; getMACFromItem(): get user MAC from hw_IP_Host_Addr.

% 2015-10-30 15:43:10.219 ; [L_DEBUG (4)] ; [13440] ; LAN ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; chkScenario: (1) user message is NasIP:2887582038,NasIpv6:,UserIP:174422274,UserIpv6:,WlanSsid:,AP:XT_JZNY_AC.

% 2015-10-30 15:43:10.220 ; [L_DEBUG (4)] ; [13440] ; LAN ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; chkScenario: (1) terminal message is Mac:(null),OS:Windows 7,Type:PC,Vendor:.

% 2015-10-30 15:43:10.220 ; [L_DEBUG (4)] ; [13440] ; CAMS ; $SYS$ ; (NULL) ; (NULL) ; (NULL) ; rcv.ifRsaAuth cur-scene(srvname:1,mac:00:00:00:00:00:00,SSID:): [SrvcTmpID:8, AREA:-1, IP:-1, WLAN:-1, MAC:0,AP:-1, V-T-O:-1_-1_-1].

从记录信息看到IMC收到终端MAC地址为全0，MAC快速认证需要终端MAC地址标示记录，没有MAC地址无法实现MAC快速认证；

2、查看设备配置信息：

#
 portal server imc ip 192.168.192.130 key cipher $c$3$jwcdAahKUTwTZ8PtjBtp8nzP4sL9VD1orjMA url http://192.168.192.130:8080/portal server-type imc
 portal mac-trigger server ip 192.168.192.130
#
radius scheme rs1
 server-type extended
 primary authentication 192.168.192.130
 primary accounting 192.168.192.130
 key authentication cipher $c$3$RDZU2fGFQixE6kA0T3mjI7T5rvbyw9IT5nEF
 key accounting cipher $c$3$NLpnl+vS0lhxpn5Go9vWKMA8mrr7xTq5Rv1m
 user-name-format without-domain
 nas-ip 172.29.1.86
#
domain dm1
 authentication portal radius-scheme rs1
 authorization portal radius-scheme rs1
 accounting portal radius-scheme rs1
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
interface Vlan-interface145
 ip address 10.101.121.62 255.255.255.192
 portal server imc method layer3
 portal domain dm1
 portal nas-ip 172.29.1.86
 portal mac-trigger enable
#

设备接口调用portal时使用三层认证，设备上启动三层认证时，radius报文中将不携带终端MAC地址。

将接口上调用的portal认证改为二层认证解决问题：

#
interface Vlan-interface145
 ip address 10.101.121.62 255.255.255.192
 portal server imc method direct
 portal domain dm1
 portal nas-ip 172.29.1.86
 portal mac-trigger enable
#